The Latvian branch of CSCTelecom, a bulk SMS provider, left a ClickHouse database open to the internet. It held more than 125 million text messages sent on behalf of Swedbank, SEB, airBaltic, Latvia's 112 emergency line, insurers, clinics and dozens of retailers across Latvia, Lithuania and Estonia. Researchers at Cybernews found the database and reported it. Every news report so far, including those from LRT/BNS, Diena, Delfi and 77.lt, repeats Cybernews' findings; none has verified the data independently. CSCTelecom has not commented publicly. None of the named banks or companies has issued a statement, and no regulator filing has been published. The 125 million figure comes from Cybernews alone. Latvian daily Diena describes the messages as ones that "may have" leaked.
What Happened
Cybernews says its research team found the open database on 28 September 2026. Diena gives the date only as "late September". The records run from October 2022 to September 2026, close to four years of traffic. According to Cybernews, the database was updated in real time: new messages appeared in it as they were sent. More than 3 million messages went through the service in September 2026 alone.
Lithuanian outlet 77.lt reports that the database has since been closed. None of the reports says when it was secured or how long it had been reachable.
CSCTelecom works mainly in Latvia, but Cybernews, Delfi and LRT all report that the leak also reached businesses and people in Lithuania and Estonia. Organisations named in the reports include:
- Banking: Swedbank Latvia and SEB Latvia
- Insurance: ERGO, Compensa and Artea (Latvia)
- Public services: Latvia's national 112 emergency line, plus unnamed government bodies and medical institutions
- Retail and services: Porsche (Latvia and Lithuania), CityBee and Barbora (Latvia), EuroCash1, DEPO (Lithuania and Estonia), Akropolis (Latvia and Lithuania), Iki, Perlas Go, Autoplius, Šypsenos akademija and Denticija
- Travel: airBaltic
Delfi notes that there is no evidence anyone else downloaded the database. Cybernews' position is that if its researchers could find it, criminals could have found it too.
What Was Taken
Cybernews lists these exposed fields:
- The names of the business customers using CSCTelecom's SMS service
- The recipients' phone numbers
- Full message text, including authentication codes, temporary passwords, password reset links, medical test results, reservation details, delivery updates with names and addresses, travel dates and bank transaction alerts
- Metadata: timestamps, per-message prices and mobile network routing details
Delfi reports that Swedbank messages held IBAN account numbers, transaction amounts, payee details and account balances. LRT, citing Cybernews, gives details for other companies:
- airBaltic: customer phone numbers, flight details and surnames
- DEPO: order IDs and order status updates
- Iki: authentication codes
- EuroCash1: security alerts about guarded premises and ATMs
- Akropolis: internal phone numbers and visitor footfall statistics
One report disagrees. Italian site vpn.social says the available reporting does not show whether message content or one-time passwords were exposed, and it treats the data types as unconfirmed. That conflicts with Cybernews' own list and its published record samples, which describe full message bodies. The original researchers are the more direct source, but until CSCTelecom or an affected company confirms the scope, the exact contents should be treated as researcher-reported, not confirmed. No report says how many individual people were affected, and 77.lt notes that no per-country figures have been released.
Why It Matters
This was not a breach at Swedbank, SEB or airBaltic. It happened at a supplier those companies share. One misconfigured database at an SMS provider exposed customers of dozens of organisations at once, however good each of those organisations' own security was.
Three points matter most for defenders:
- One-time codes could be read live. Because the database updated in real time, anyone watching it could have read login codes and password reset links before the recipient did. That turns SMS-based two-factor authentication into a single factor for anyone with access to the database.
- Four years of history is enough to profile people. Voldemaras Kadys of Mediatech, the company that runs Cybernews, said in comments carried by LRT that the archive makes it possible to "build extremely detailed profiles" of individuals: their banks, shops, travel, health appointments and finances. That makes very convincing phishing possible, for example a fake Swedbank SMS that quotes a real IBAN and balance.
- It raises GDPR questions. Kadys points to GDPR's storage limitation principle. Keeping full message bodies, including bank balances and medical results, for four years is hard to justify for a delivery provider. Data protection authorities in all three Baltic states could take an interest.
Telecom infrastructure is under pressure from more capable attackers too. SecurityWeek reported on 19 October 2026 that Palo Alto Networks linked UNC5820 to a long-running intrusion at an unnamed telecom organisation. The group used Fortinet flaws CVE-2024-47575 and CVE-2025-61624 to plant an in-memory FortiGate implant called PeerStitch. Nothing connects that campaign to CSCTelecom. It is a separate incident, but it shows how much attention messaging and telecom providers get from well-resourced attackers.
The Attack Technique
There is no evidence of an intrusion. Every account describes a misconfiguration: a ClickHouse database reachable from the public internet without access controls. No threat actor has been named, and no one has claimed to hold the data. The main open question is whether anyone other than the researchers accessed the live data during the exposure window. Only CSCTelecom's server logs can answer that, and the company has not said whether it has checked them.
What Organizations Should Do
- Audit your SMS and messaging suppliers. Ask your providers how long they keep message bodies and where. Require them to delete content after delivery, or soon after, and to keep only the metadata they need for billing.
- Keep secrets out of SMS. Stop sending balances, IBANs, medical results and password reset links by text. Send a prompt to log in to a secure channel instead.
- Move off SMS for authentication. For banking and other sensitive accounts, use passkeys, authenticator apps or push approval with number matching. Treat SMS codes as a weak fallback.
- Scan for exposed data stores. Check regularly for internet-facing ClickHouse, Elasticsearch, MongoDB and similar services, both your own and your suppliers'. Require authentication and network restrictions by default.
- Warn customers about targeted phishing. If you are a CSCTelecom customer, tell your users to expect convincing fraud messages that quote real transactions, orders or flights, and confirm which channels you will never use to ask for codes.
- Check your notification duties. Controllers whose customers' data sat in the exposed database should assess their GDPR breach-notification obligations now, not wait for the supplier's findings.
Sources: Huge leak exposes Swedbank, SEB, airBaltic and other companies’ cli... | Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Tele... | Over 125m leaked text messages expose data of Lithuanian companies... | Atvira SMS bazė: matyti IKI, DEPO — 77.lt | No CSCTelecom Latvijas atzara datubāzes varētu būt noplūduši 125 mi... | Утечка SMS-данных затронула клиентов airBaltic и DEPO - Delfi RUS | La fuga di dati CSCTelecom colpisce i clienti di Swedbank, SEB e ai... | Maersk confirms cyberattack after hackers access old IT ...