Summary
- Researchers discovered approximately 125 million SMS records accessible through a telecommunications provider's database.
- The exposed material reportedly included authentication codes, temporary passwords, and confidential customer communications.
- Affected organisations are assessing their exposure, while evidence of malicious retrieval remains unconfirmed.
Approximately 125 million text messages sent through a Baltic telecommunications provider were exposed through an unsecured database, potentially revealing authentication codes, sensitive personal information, and communications associated with banks and other essential services.
Researchers identified the exposed database within infrastructure operated by the Latvian business of CSC Telecom, a provider of telecommunications services to commercial and public-sector customers.
The findings were disclosed on 11 November following an investigation by Cybernews, whose research team discovered the database in late September.
Records reportedly covered messages sent between October 2022 and September 2026, including communications involving banks, insurance businesses, retailers, healthcare providers, transport operators, and emergency services.
The exposed ClickHouse database contained telephone numbers and message contents, alongside information about message delivery and routing.
Researchers said some records included one-time authentication codes, temporary passwords, password-reset links, medical information, and details of customer transactions.
There is currently no confirmed evidence that criminals obtained the exposed records or used them to compromise individual accounts.
Messaging infrastructure creates third-party exposure
Organisations frequently depend on external telecommunications providers to deliver transactional messages to customers, including account notifications, booking confirmations, security alerts, and authentication codes.
Those providers can process sensitive information even when they do not operate the underlying banking, healthcare, or retail systems.
The reported exposure demonstrates how a failure within a messaging intermediary can potentially affect numerous organisations whose own application infrastructure remains secure.
According to the researchers, the database contained messages associated with businesses operating across Latvia, Lithuania, and Estonia.
The material reportedly included communications involving Swedbank, SEB, airBaltic, insurance providers, and multiple retail organisations.
Latvian public broadcasting service LSM also reported that messages associated with the country’s emergency assistance services appeared among the records.
The presence of an organisation’s name within a messaging database does not establish that its internal systems were compromised. The relevant exposure concerns information transmitted through the affected provider.
Banks distinguish messaging exposure from account security
SEB has issued a statement clarifying the limited nature of its relationship with CSC Telecom.
The bank said it used the provider only to distribute general information about pension funds, supplying telephone numbers and the text of those messages.
It did not transmit online banking authentication codes, passwords, payment information, or customer account details through the service.
SEB also stated that the incident had not affected its banking systems or customer funds.
These distinctions are important because the existence of exposed messages associated with a bank does not necessarily mean that online banking credentials were compromised.
Swedbank has urged customers to remain vigilant while it investigates the circumstances of the exposure. Latvian reporting indicates that it suspended use of the affected provider and sought further information about the incident.
AirBaltic is also examining the potential consequences for customers, with the number of affected individuals not yet established.
Authentication codes present particular risks
One-time passcodes and password-reset messages can provide opportunities for account takeover if attackers obtain them while they remain valid.
Such messages are time-sensitive, and access to a code alone may not be sufficient to compromise an account protected by additional authentication requirements.
Nevertheless, an accessible database receiving new messages in real time can present a more serious exposure than an archive containing only expired codes.
The Cybernews investigation reported that the database continued to receive messages while it was accessible, potentially allowing an unauthorised observer to view information before the intended recipient acted on it.
Authentication codes were not the only potentially sensitive material. Message contents and telephone numbers could also reveal relationships between individuals and service providers or support targeted social-engineering attempts.
Delivery notifications containing names and addresses, healthcare communications, and transaction-related messages may have privacy implications even where no authentication credentials are involved.
Investigation continues into actual access
Latvia’s national computer emergency response organisation, CERT.LV, has reportedly requested a detailed investigation from CSC Telecom, offered assistance, and referred information to law enforcement.
The investigation must establish how the database became accessible, how long the exposure persisted, and whether there is evidence that unauthorised parties retrieved information.
The number of messages in the database is not equivalent to the number of individuals affected, as one person may have received multiple messages over the period examined.
Likewise, an accessible database should not automatically be described as confirmed malicious data theft.
Companies using third-party messaging services need visibility over how messages are stored, who can retrieve them, and how long sensitive communications remain accessible after delivery.
For organisations using SMS-based authentication, the incident also reinforces the importance of evaluating alternatives that bind authentication more closely to the intended service and user.
The immediate findings establish a substantial exposure of messaging records through shared telecommunications infrastructure. The extent of unauthorised retrieval, any subsequent misuse, and the notification obligations arising from the incident remain under investigation.
