Illustrative image: a phone showing a text message. Image: Wikimedia Commons.
📌 Key highlights
- 125 million+ SMS messages sat in a publicly accessible ClickHouse database, spanning 20 October 2022 to September 2026 — and it updated in real time.
- Bank details exposed: Swedbank messages included IBAN numbers, transaction amounts, recipients and remaining balances; SEB customers' phone numbers were also in the database.
- One-time codes at risk: authentication codes and password-reset links were visible live, so an attacker monitoring the feed could have used a code before the real recipient saw it.
- Emergency and medical data too: Latvia's 112 emergency hotline cases, medical test results, insurance documents and airBaltic flight details were among the messages.
- No confirmed misuse — yet: researchers found no evidence that criminals accessed the database, but it was open for years and the company has not commented.
What happened?
Cybernews' research team discovered the exposed database on 28 September 2026 and published its findings today, 11 November 2026. The database belonged to the Latvian branch of CSCTelecom, a telecommunications provider that sends SMS messages on behalf of banks, shops, insurers, clinics and government services across the Baltic states.
The database was not password-protected. Anyone who found it could read the full contents of messages as they arrived — more than 3 million messages passed through the system in September 2026 alone. Cybernews told CSCTelecom about the exposure on 29 September, and the database was observed closed on 27 October 2026. The company had not responded to a request for comment when the findings were published.
This is not a hack in the usual sense: nobody broke into CSCTelecom's systems. The data was simply left open on the internet. But the effect is the same — years of private messages, including the codes that protect bank accounts, were readable by anyone who stumbled across the database.
What was exposed?
The database held recipient phone numbers, the complete text of every message, and metadata such as timestamps, message prices and mobile-network routing information. Because the feed updated in real time, an attacker watching it could have intercepted a one-time code or password-reset link the moment it was sent — potentially before the intended recipient even looked at their phone.
| Organisation | What the messages revealed |
|---|---|
| Swedbank (Latvia) | IBAN numbers, transaction amounts, recipients, remaining balances, and in some cases the physical store where a purchase was made |
| SEB (Latvia) | Customers' phone numbers linked to bank messaging |
| Latvia 112 emergency hotline | Phone numbers and case details from emergency calls |
| ERGO insurance | Document numbers, vehicle registration numbers, phone numbers and invoice amounts |
| airBaltic | Customer phone numbers, flight details and last names |
| CityBee, IKI and others | Phone numbers and authorisation codes for car-sharing and grocery accounts |
| Healthcare providers | Medical test results and appointment details |
Retailers and services including Porsche, Barbora, EuroCash, DEPO, Akropolis, PerlasGo and Autoplius also had customer messages in the database. The exposure was centred on Latvia but also affected businesses and individuals in Lithuania and Estonia.
Illustrative image: a text message on a phone. Image: Wikimedia Commons.
Why it matters for Europe readers
The danger here is bigger than any single message. With four years of SMS history, an attacker could build a detailed profile of almost anyone in the database: which bank they use, where they shop, when they travel, what medical tests they have had and how much money they spend. Phone numbers tied to luxury brands or high bank balances could be used to pick out the most lucrative targets for fraud.
Even without reading message contents, simply knowing which services a phone number uses makes phishing far more convincing. A scam text pretending to be from Swedbank lands very differently when the attacker already knows you bank with Swedbank, shop at Barbora and fly airBaltic.
The leak also raises a GDPR question: European law requires personal data to be kept no longer than necessary, so why did an SMS provider retain message contents, phone numbers and metadata for nearly four years? That is a question regulators in Latvia are likely to ask.
Bank data exposures are becoming a pattern — India's largest bank, SBI, confirmed a customer data leak of its own in October (see our SBI customer data leak explained), and the Fireworks AI breach showed how a single supplier can expose many companies' customers at once. CSCTelecom is the same story one level deeper: the supplier nobody thinks about.
What should you do?
✅ If you received SMS messages from any of the affected organisations in the past four years, assume your information was exposed. The researchers' advice is straightforward:
- Change your passwords — especially for banking, email and any account that used SMS-based two-factor authentication.
- Switch to app-based two-factor authentication wherever possible, using an authenticator app such as Google Authenticator or Authy, or the built-in option in a password manager. SMS codes have no encryption and can be intercepted, SIM-swapped or read from a leak like this one.
- Watch for phishing that references specific services you use — a message that knows your bank, your recent flight or your medical appointment is far more persuasive than a generic scam.
- Monitor your accounts for unauthorised access, especially financial accounts and any service that sent you password-reset links or authentication codes by SMS.
- Be cautious of unsolicited contact referencing your travel plans, medical appointments or shopping habits — that information could have come from the leaked messages.
Many of the affected services may not offer an alternative to SMS authentication, which leaves their users with little choice but to stay alert. If your bank offers app-based authentication or in-app approvals, turn it on now rather than waiting for a notification that may never come.
FAQs
Was my data in the CSCTelecom leak? If you live in Latvia, Lithuania or Estonia and received SMS messages from Swedbank, SEB, airBaltic, ERGO, the 112 hotline or the other listed organisations at any point since October 2022, your messages may have been in the database. The researchers advise assuming exposure and acting on it rather than waiting for confirmation.
Did hackers steal the messages? There is no evidence that criminals accessed the database. But the researchers found it through ordinary internet scanning, and it had been open for years — so it cannot be ruled out that others found it first. The database was closed on 27 October 2026.
What should Swedbank and SEB customers do? Change the passwords on banking and email accounts, enable app-based two-factor authentication if your bank supports it, check recent transactions for anything unfamiliar, and treat any unexpected message claiming to be from your bank with suspicion — especially one that references real details about you.
Is SMS two-factor authentication still safe? SMS was never secure: texts have no end-to-end encryption, and codes can be intercepted through SIM swapping, network attacks or a leak like this one. Authenticator apps and in-app approvals are safer. SMS codes are still better than no second factor at all, but they should not be your only protection on important accounts.
Takeaway: A single SMS provider's open database exposed 125 million messages — bank balances, one-time codes and emergency cases — across three countries. The database is closed, but the messages cannot be taken back: change passwords, move to app-based authentication, and treat any message that knows too much about you as a possible scam.
If your bank offers app-based login approval, switch it on today — and check our Wyndham app breach explainer for what to do when an app you trust leaks your data.
Sources
- Cybernews — "Huge leak exposes Swedbank, SEB, airBaltic and other companies' clients" (primary source: Cybernews research team findings, published 11 November 2026)
Comments
Post a Comment