125 Million SMS Left Open: Latvian Telecom CSC Telecom Exposed Four Years of Live Bank Alerts, One-Time Codes and 112 Messages Across the Baltics
An unauthenticated ClickHouse database at CSC Telecom's Latvian branch exposed 125M+ SMS from Swedbank, SEB, airBaltic, 112 and others, updated in real time from 2022 to 2026.
What Happened
An open database belonging to the Latvian branch of CSC Telecom, a provider of bulk and business SMS services in the Baltics, exposed more than 125 million text messages to anyone who knew where to look. Researchers found the ClickHouse instance in late September 2026, reachable from the internet with no authentication. The story became public on November 11–12, 2026, once Latvian and Lithuanian media picked it up.
The messages are dated from October 2022 to September 2026. More than three million were sent in September 2026 alone. The database was also live: new messages showed up in it as they joined the sending queue, so anyone watching could read them almost as fast as the recipients did.
What Was in the Messages
CSC Telecom sends messages for businesses, the kind of automated texts banks, airlines, shops and clinics send their customers. According to the researchers, each record held:
- The name of the client company that sent the message
- The recipient's phone number
- The full message text
- Timestamps, message cost and mobile-network routing metadata
Across four years of traffic, the message text included one-time login codes, temporary passwords, password-reset links, bank transaction alerts, medical test results, booking and flight details, and delivery notices with names and addresses. Bank alerts reportedly showed IBANs, exact transaction amounts, the recipient of the payment and the remaining balance.
Who Is Affected
Most of the traffic was in Latvia, with messages also going to people in Lithuania and Estonia. The senders named so far include:
- Banks and insurers: Swedbank, SEB, ERGO, Compensa and Artea
- Emergency services: Latvia's 112 emergency line
- Travel and mobility: airBaltic, in all three Baltic states, and CityBee
- Retail and services: Porsche (Latvia and Lithuania), Barbora, EuroCash, DEPO, Akropolis, IKI, PerlasGo and Autoplius
- Healthcare: the Lithuanian dental clinics Šypsenos akademija and Denticija
The 125 million figure counts messages, not people. One customer can receive hundreds of alerts and codes a year, so the number of people affected is much smaller, but it hasn't been measured.
How the Companies Responded
- Swedbank opened an investigation, has suspended its use of the provider, and is working out what this means for customers. It told customers to be on the lookout for suspicious messages.
- SEB says it used CSC Telecom only in limited volume, for pension-fund marketing messages. It says the provider did not tell it about the incident and that the bank's own systems are not affected.
- airBaltic says it is assessing the situation with the provider and the regulators, and that it is too early to say how much data or how many customers are involved.
None of the reporting so far includes a detailed public statement from CSC Telecom. It's also not yet clear exactly when the database was locked down.
Was the Data Actually Stolen?
This is a confirmed exposure, not a confirmed theft. A Latvian security expert said the provider appears to have made the system public by mistake, and that anyone who found it could have read messages in real time. Whether anyone other than the researchers did, or misused what they saw, is still unknown.
The risk is that open databases like this are found quickly by automated scanners. The longer one stays open, the less anyone can rule out that someone copied it.
Why It Matters
Live one-time codes. Because the database updated in real time, anyone watching it could have read a login code or reset link while it was still valid. That turns SMS-based two-factor authentication into a single factor for anyone with a phone number and a password.
Ready-made phishing material. Four years of real messages from real brands show exactly how each bank, airline and shop words its texts, and who their customers are. A fake message that quotes a genuine transaction amount or flight number is far more convincing than generic smishing.
Data kept far too long. Keeping full message contents in readable form for nearly four years is hard to square with GDPR's data-minimisation principle. Expect questions from data protection authorities in all three Baltic states.
Supply-chain blind spot. None of the named brands were breached themselves. Their customers' data was exposed through an SMS vendor, the kind of third party that is rarely included in security reviews, even though it handles authentication codes and financial alerts.
What You Should Do
If you live in the Baltics or bank with any of the companies named:
- Treat unexpected calls and texts with suspicion, even if they quote real transactions or bookings. Check through the official app or a number you look up yourself.
- Never share a one-time code with anyone, including someone who says they're from your bank.
- Move important accounts from SMS codes to an authenticator app, Smart-ID or passkeys where you can.
- Change passwords on accounts where you've used SMS reset links, and watch your bank and card activity for anything you don't recognise.
What Organisations Sending SMS Should Do
- Ask SMS vendors in writing how long they keep message contents, where they store them, and who can access them. Put deletion schedules in the contract.
- Stop putting balances, account numbers and health results in text messages. Send a prompt to open the app instead.
- Make reset links and one-time codes single-use and short-lived, so a copy is worthless within minutes.
- Add messaging and notification providers to third-party risk reviews, and have a plan ready for incidents on the vendor's side, including customer notification.
The Bottom Line
The CSC Telecom exposure is one of the largest SMS leaks reported in Europe. There's no evidence of misuse yet, but the database was open, live and holding years of authentication codes and financial alerts. Baltic customers should expect better-targeted phishing in the months ahead, and companies that rely on SMS should take this as a prompt to look hard at what their vendors keep.
