---
title: "125 million SMS from banks, 112, and retail: authentication codes and personal data leaked from Latvian CSCTelecom database"
description: "Over 125 million SMS messages from Swedbank, SEB, 112, and retail leaked from a public Latvian CSCTelecom database for 2022–2026. The breach affected Latvia, Lithuania, and Estonia; banks have suspended cooperation with the provider."
date: 2026-11-12T10:37:53.626Z
lang: en
url: https://xab.info/en/posts/leak-125-million-sms-csctelecom-latvia-banks
tags: [data-breach, sms-leak, csctelecom, latvia, swedbank, seb, cybersecurity, baltics, airbaltic]
author: "Alexander Buran"
publisher: "XAB.info"
---

# 125 million SMS from banks, 112, and retail: authentication codes and personal data leaked from Latvian CSCTelecom database

## Key Points

- Over 125 million SMS messages sent between October 2022 and September 2026 became publicly accessible from a ClickHouse database belonging to Latvia's CSCTelecom
- The leak affected customers of Swedbank, SEB, 112, insurance companies, retailers, and AirBaltic across Latvia, Lithuania, and Estonia
- The database updated in real-time, allowing authentication codes to be intercepted before reaching the recipient
- Swedbank suspended CSCTelecom services and launched an investigation; SEB stated it only used the provider for pension fund marketing

The Latvian branch of telecommunications service provider CSCTelecom has become the source of one of the largest SMS data leaks in Baltic history. According to the Cybernews research team, a security vulnerability left a ClickHouse database publicly accessible, containing over 125 million SMS messages sent between October 2022 and September 2026. The leak affected customers in Latvia, Lithuania, and Estonia, including messages from major banks, the 112 emergency service, insurance companies, medical institutions, and dozens of retail chains.

### What exactly became publicly available

According to a publication by LSM.lv, the compromised database contained not only recipient phone numbers and sender enterprise names, but also the full content of every SMS: authentication codes, temporary passwords, medical test results, booking information with names and addresses, delivery updates, travel dates, and banking transaction notifications. In addition to the message text itself, metadata was available—timestamps, sending costs, and mobile network routing information. A critical circumstance was that the database updated in real-time: an attacker gaining access could intercept authentication codes and password reset links even before the recipient opened the message.

### Scale: three million SMS in a single month

Cybernews researchers discovered the vulnerable ClickHouse database in late September 2026. According to their estimates, in September alone, the CSCTelecom service sent over three million SMS messages. Senders included Latvian banks Swedbank and SEB, insurance companies ERGO, Compensa, and Artea, the national emergency helpline 112, retailers Porsche in Latvia and Lithuania, delivery services CityBee and Barbora (Latvia), EuroCash (Lithuania), DEPO (Lithuania and Estonia), Akropolis networks (Latvia and Lithuania), IKI and PerlasGo (Lithuania), Autoplius (Latvia and Lithuania), medical enterprises Sypsenos akademija and Denticija (Lithuania), and national flag carrier AirBaltic, operating across all three Baltic states.

### Bank reactions: from 'pension fund marketing' to suspension of cooperation

Anete Igaunija, Head of Corporate Communications at SEB's Latvian branch, stated that the bank used CSCTelecom's services on a limited basis and exclusively for marketing mailings regarding pension funds. According to her, SEB uses other communication channels to transmit confidential customer information, and the incident itself 'does not affect the security of SEB systems and poses no threat to confidential customer information or their funds.' However, Igaunija noted that CSCTelecom did not inform SEB directly about the incident.

Swedbank Latvija's position was much firmer. Bank representative Kristīne Čекstere told the LETA news agency that upon receiving information about the incident, Swedbank immediately launched an investigation, took all regulatory-mandated actions, and suspended the use of CSCTelecom services. The bank requested all necessary information from the provider to assess the scale of the incident and its potential impact on customers. Swedbank also urged clients to remain vigilant and avoid trusting suspicious SMS, calls, or emails requesting personal data, passwords, or authentication codes.

### AirBaltic and other companies: assessment ongoing

AirBaltic representatives confirmed to LETA that the airline is aware of the reported information regarding a potential data security incident in the systems of an external service provider. The company stated it takes the situation 'very seriously,' as data security and customer privacy are among its top priorities. AirBaltic has initiated an internal assessment and is cooperating closely with involved service providers and regulatory authorities. Similar procedures, following regulatory requirements, must be launched by other affected organizations—ranging from insurance companies to medical facilities.

### What this means for users

The leak of 125 million SMS messages spanning nearly four years essentially covers the digital daily life of millions of people across the three Baltic states. Since the database contained authentication codes and temporary passwords, even if they have already expired, their presence in the public domain creates a risk for social engineering: an attacker knowing that a specific user received codes from a specific bank or service can use this information for more convincing phishing attacks. Cybersecurity experts in such cases recommend that users of banking and government services enable two-factor authentication via channels other than SMS and carefully inspect any incoming messages requesting personal data. Regulatory authorities in Latvia, Lithuania, and Estonia will likely be required to conduct their own investigations under GDPR and national data protection laws.

## Fact-Check & Sources

- [Из базы данных CSCTelecom в Латвии могли утечь 125 млн SMS-сообщений клиентам](https://rus.err.ee/1610193136/iz-bazy-dannyh-csctelecom-v-latvii-mogli-utech-125-mln-sms-soobwenij-klientam) - Primary source: full leak details, list of affected companies, comments from SEB, Swedbank, AirBaltic. Data matches the core article.
- [Из базы данных CSCTelecom в Латвии могли утечь 125 миллионов SMS клиентам, в том числе от банков и ...](https://rus.lsm.lv/statja/novosti/obschestvo/11.11.2026-iz-bazy-dannyx-csctelecom-v-latvii-mogli-utec-125-millionov-sms-klientam-v-tom-cisle-ot-bankov-i-torgovcev-izdanie.a671536/) - Independent Latvian publication LSM.lv confirms the leak, the timeframe (October 2022 – September 2026), the list of senders, and the real-time mechanism. Data aligns with source 1.

## FAQ

### What volume of data leaked from the CSCTelecom database?

According to Cybernews, over 125 million SMS messages sent between October 2022 and September 2026 became publicly accessible. In September 2026 alone, the service sent over three million messages.

### Which companies and services were affected by the leak?

Senders included Swedbank and SEB banks, insurance companies ERGO, Compensa, Artea, the 112 service, Porsche, CityBee, Barbora, EuroCash, DEPO, Akropolis, IKI, PerlasGo, Autoplius, AirBaltic, and Lithuanian medical enterprises Sypsenos akademija and Denticija.

### What exactly did the leaked data contain?

The database included recipient phone numbers, sender names, the full content of SMS (authentication codes, temporary passwords, medical test results, booking details, bank transaction alerts), as well as metadata: timestamps, costs, and routing information.

### How did Swedbank and SEB react?

Swedbank suspended CSCTelecom services, launched an investigation, and urged clients to be vigilant. SEB stated it only used the provider for pension fund marketing mailings and stressed that the incident did not affect client data security or funds.

### Did the leak affect countries other than Latvia?

Yes. Although CSCTelecom operates primarily in Latvia, the leak also affected businesses and individuals in Lithuania and Estonia, including customers of DEPO, IKI, PerlasGo, EuroCash, Porsche, and AirBaltic.