125 Million Text Messages Left Open Online by a Baltic SMS Provider: What the CSCTelecom Leak Means for Every Business That Sends Codes by Text

Most organisations think of text messages as something they send and forget. A leak disclosed this week in the Baltic states is a reminder that every message also sits on someone else's server, sometimes for years.

Researchers at Cybernews found a database belonging to the Latvian branch of CSCTelecom, a business SMS provider, open on the internet without any authentication. It held more than 125 million text messages sent on behalf of banks, insurers, airlines, retailers, clinics and Latvia's emergency service between October 2022 and September 2026, and it was being updated as new messages went out. Among them were one-time login codes, password reset links and bank transaction alerts.

What Happened

According to Cybernews, its team discovered the exposed database, which ran on the ClickHouse analytics platform, on 28 September 2026 and reported it the following day. At the time the service was sending around 3 million messages a month. The researchers say the database was closed by 27 October. They published their findings on 11 November, and Latvian, Lithuanian and Estonian media followed on 12 November.

The contents went well beyond phone numbers. Cybernews describes one-time authentication codes, temporary passwords and password reset links; bank notifications showing account numbers, transaction amounts, recipients, balances and in some cases the shop where a purchase was made; medical test results and appointment details; flight and reservation details; delivery updates with names and addresses; and messages linked to Latvia's 112 emergency line. Each message came with metadata such as the sending organisation, the recipient's number, timestamps, the price of the message and how it was routed across mobile networks.

What the Companies Have Said

CSCTelecom has not responded publicly to the researchers, according to Cybernews. The insurer Artea said the provider had described the incident as an access configuration weakness that had been fixed, with no signs of attack or misuse of data so far. Artea suspended its use of the service and opened an internal investigation, adding that its messages did not contain names, personal ID numbers or special category data.

SEB in Latvia said it used CSCTelecom only to a limited extent, for pension fund marketing messages, sends sensitive information through other channels, and had not been told about the incident by the provider. Swedbank told Latvian media that the security of its systems, sensitive customer data and funds had not been affected, that it had suspended use of the service and started its own investigation, and urged customers never to share passwords, personal data or authentication codes in response to unexpected calls or messages. airBaltic said it was assessing the impact with the provider and warned customers to be wary of messages pressing them to follow a link, confirm a booking or provide payment details.

Who Is Affected

The people at risk are those who received texts from any of the organisations that used the service in the last four years, mainly in Latvia but also in Lithuania and Estonia. Cybernews named, among others, Swedbank and SEB in Latvia, airBaltic, the insurers ERGO, Compensa and Artea, Latvia's 112 service, Porsche dealers in Latvia and Lithuania, the car sharing service CityBee, the online grocer Barbora, the retailers DEPO, IKI and EuroCash, the shopping centre operator Akropolis, and dental and healthcare providers in Lithuania. Being on that list does not mean every customer of those organisations was affected, and several of them say their use of the service was limited.

There is no public evidence that criminals accessed the database. But it was open for at least a month after it was found, and nobody can say who else found it in that time.

Why It Matters

An SMS provider is a classic hidden supplier. Customers never see it, and the businesses using it often think of it as a pipe rather than a store. Yet this one appears to have kept the full content of four years of messages, which raises obvious questions about data minimisation and retention under GDPR.

The data itself is a fraudster's toolkit. Real-time access to login codes and reset links can be enough to take over accounts that rely on text message verification. Years of bank, travel, shopping and medical messages make it easy to build convincing, personalised scams: a fake airline rebooking that quotes the right flight, a fake bank call that knows your last three purchases. And because these messages came from brands people already trust, the phishing that follows is harder to spot.

It also adds to the long-standing case against relying on SMS for security. Text messages are not end-to-end encrypted, they can be intercepted through SIM swaps and weaknesses in mobile network signalling, and as this case shows, they can leak from the systems that send them.

What To Do Now

If you send texts to customers, find out who your SMS providers are. Marketing, operations and IT may each have their own. For each one, ask what message content and metadata it stores, for how long, where, and how access is controlled and monitored.

Put less in the message. Keep account numbers, balances, medical details and full names out of texts where you can. Send a prompt to log in instead.

Make retention and breach notification contractual. Agree how long a provider may keep content, require deletion after delivery where possible, and set a deadline for telling you about any incident. Several of the organisations named here learned of the leak from researchers and the press.

Move away from SMS codes for sign-in. Offer authenticator apps, passkeys or push approval in your app, and make them the default for higher-risk accounts.

Warn your customers. If you used the service, tell customers in plain language what to expect and how you will and will not contact them. The banks and airBaltic have done this already.

As an individual, be suspicious of accurate detail. A message that knows your flight or your last purchase is not proof that it is genuine. Contact the organisation through its app or a number you already have, and never share a code you did not ask for.

How Cybergen Can Help

Cybergen's third-party and supply chain risk management service helps organisations find hidden suppliers like SMS gateways and check what they hold. Our identity security work helps move customers and staff onto stronger sign-in, and our threat intelligence service can watch for your brand being used in follow-on phishing.

Frequently Asked Questions