Latvia

Situation Summary

Latvia faces a compound security crisis combining kinetic aerial threats, critical political instability, and sustained Russian cyber and information operations. Three drone incursions in recent days—culminating in a crash and fire at an oil storage facility in Rēzekne—have exposed air-defense gaps and triggered the resignation of the prime minister. The country's threat landscape remains dominated by Russian cyberattacks, sabotage preparation, and DDoS campaigns targeting government and critical infrastructure, with the Constitution Protection Bureau confirming cyber threats reached an all-time high in 2025.

Key Developments

• Rēzekne, 2026-06-04 — Drone crashed at an oil storage site, igniting fire in empty tanks; second confirmed drone incursion event in days, prompting government air-security review.
• Latvia airspace (nationwide), 2026-06-03 to 2026-06-04 — Three drones entered Latvian airspace; early warning to civilians delayed by approximately one hour, exposing civil-preparedness and air-defense coordination weaknesses.
• Riga (national government), 2026-06-04 — Prime minister resigned; reporting links resignation to security crisis response and criticism of state defense capabilities following drone incursions.
• Latvia-wide, 2026-06-04 — Government announced tighter air-security measures and airspace hardening in response to drone intrusions.
• Riga / national cyber defense, 2026-06-04 — Constitution Protection Bureau confirmed Russia remains primary cyber threat; registered cyberthreat level at all-time high in 2025; active DDoS waves target government, municipal, and critical-infrastructure networks.
• Latvia / critical infrastructure, 2026-06-04 — SAB reported ongoing Russian sabotage preparation, information operations, and reconnaissance of industrial control systems (ICS) aimed at critical infrastructure and public confidence.
• Municipal service provider ICS, 2026-06-04 — Preventive monitoring identified vulnerabilities in municipal service provider's control systems; no major incident registered to date.

Highest-Risk Areas

Eastern Latvia—specifically Rēzekne, Daugavpils, and their surrounding novads—dominates the sub-national risk ranking (scores 48–68), reflecting geographic proximity to the Russia-Belarus border, exposure to cross-border drone and kinetic activity, and likely higher concentrations of critical energy infrastructure. The clustering of risk in the Latgale region indicates vulnerability to both direct aerial/military threat and cascading failures in energy supply. Western and central municipalities show significantly lower composite risk, suggesting the threat environment is geographically concentrated in border-proximate zones but that national-level cyber and political instability create systemic exposure across all regions.

How GeoBit Would Assist

Security and risk teams managing assets in Latvia should employ AOI Monitoring & Early Warning on Rēzekne, Daugavpils, and other high-risk eastern municipalities to detect drone activity and cross-border intrusion patterns in near-real time. Cyber threat intelligence and network analysis capabilities—combined with multi-language OSINT fusion of Latvian government and critical-infrastructure reporting—enable continuous tracking of Russian DDoS campaigns, ICS reconnaissance, and sabotage preparation targeting specific sectors. Satellite and imagery analysis of energy facilities, telecommunications nodes, and government installations in high-risk areas provide independent verification of infrastructure vulnerability and early-warning capability ahead of coordinated kinetic or cyber events.

7-Day Outlook

Political instability and air-defense gaps will likely persist over the coming week as Latvia's government transition unfolds and air-security protocols are reset. Russian cyber and DDoS activity is expected to continue on regular cadence, with heightened vigilance required around politically sensitive dates. Corporate assets in Rēzekne, Daugavpils, and energy-sector facilities across eastern Latvia should assume elevated kinetic and cyber risk through mid-June.

Highest-Risk Areas — Ranked