125 million SMS from banks, 112, and retail: authentication codes and personal data leaked from Latvian CSCTelecom database

The Latvian branch of telecommunications service provider CSCTelecom has become the source of one of the largest SMS data leaks in Baltic history. According to the Cybernews research team, a security vulnerability left a ClickHouse database publicly accessible, containing over 125 million SMS messages sent between October 2022 and September 2026. The leak affected customers in Latvia, Lithuania, and Estonia, including messages from major banks, the 112 emergency service, insurance companies, medical institutions, and dozens of retail chains.

What exactly became publicly available

According to a publication by LSM.lv, the compromised database contained not only recipient phone numbers and sender enterprise names, but also the full content of every SMS: authentication codes, temporary passwords, medical test results, booking information with names and addresses, delivery updates, travel dates, and banking transaction notifications. In addition to the message text itself, metadata was available—timestamps, sending costs, and mobile network routing information. A critical circumstance was that the database updated in real-time: an attacker gaining access could intercept authentication codes and password reset links even before the recipient opened the message.

Scale: three million SMS in a single month

Cybernews researchers discovered the vulnerable ClickHouse database in late September 2026. According to their estimates, in September alone, the CSCTelecom service sent over three million SMS messages. Senders included Latvian banks Swedbank and SEB, insurance companies ERGO, Compensa, and Artea, the national emergency helpline 112, retailers Porsche in Latvia and Lithuania, delivery services CityBee and Barbora (Latvia), EuroCash (Lithuania), DEPO (Lithuania and Estonia), Akropolis networks (Latvia and Lithuania), IKI and PerlasGo (Lithuania), Autoplius (Latvia and Lithuania), medical enterprises Sypsenos akademija and Denticija (Lithuania), and national flag carrier AirBaltic, operating across all three Baltic states.

Bank reactions: from 'pension fund marketing' to suspension of cooperation

Anete Igaunija, Head of Corporate Communications at SEB's Latvian branch, stated that the bank used CSCTelecom's services on a limited basis and exclusively for marketing mailings regarding pension funds. According to her, SEB uses other communication channels to transmit confidential customer information, and the incident itself 'does not affect the security of SEB systems and poses no threat to confidential customer information or their funds.' However, Igaunija noted that CSCTelecom did not inform SEB directly about the incident.

Swedbank Latvija's position was much firmer. Bank representative Kristīne Čекstere told the LETA news agency that upon receiving information about the incident, Swedbank immediately launched an investigation, took all regulatory-mandated actions, and suspended the use of CSCTelecom services. The bank requested all necessary information from the provider to assess the scale of the incident and its potential impact on customers. Swedbank also urged clients to remain vigilant and avoid trusting suspicious SMS, calls, or emails requesting personal data, passwords, or authentication codes.

AirBaltic and other companies: assessment ongoing

AirBaltic representatives confirmed to LETA that the airline is aware of the reported information regarding a potential data security incident in the systems of an external service provider. The company stated it takes the situation 'very seriously,' as data security and customer privacy are among its top priorities. AirBaltic has initiated an internal assessment and is cooperating closely with involved service providers and regulatory authorities. Similar procedures, following regulatory requirements, must be launched by other affected organizations—ranging from insurance companies to medical facilities.

What this means for users

The leak of 125 million SMS messages spanning nearly four years essentially covers the digital daily life of millions of people across the three Baltic states. Since the database contained authentication codes and temporary passwords, even if they have already expired, their presence in the public domain creates a risk for social engineering: an attacker knowing that a specific user received codes from a specific bank or service can use this information for more convincing phishing attacks. Cybersecurity experts in such cases recommend that users of banking and government services enable two-factor authentication via channels other than SMS and carefully inspect any incoming messages requesting personal data. Regulatory authorities in Latvia, Lithuania, and Estonia will likely be required to conduct their own investigations under GDPR and national data protection laws.