CSCTelecom data breach: 125 million text messages from Swedbank, SEB and 112 publicly accessible
An unsecured database belonging to CSCTelecom's Latvian branch has exposed 125 million text messages, including authentication codes and medical data. The breach also affects Lithuania and Estonia.
CSCTelecom database flaw exposes 125 million sensitive text messages
A database belonging to telecommunications company "CSCTelecom"'s Latvian branch contained publicly accessible information about over 125 million text messages — including authentication codes, temporary passwords and medical data. This is reported by online publication "Cybernews", whose research team discovered the vulnerability at the end of September.
The data contained in the database covers a period from October 2022 to September 2026. The system was updated in real-time, which means that malicious actors could theoretically have intercepted messages before the recipient had read them. In September alone, the service sent over three million text messages.
Content of the leaked data
According to "Cybernews" data, the publicly accessible database contained:
- client company names and telephone numbers;
- full text message content — authentication codes, temporary passwords, medical test results;
- reservation information, delivery updates with names and addresses;
- bank transaction notifications and travel reservation dates;
- metadata — timestamps, message prices and mobile network routing information.
Affected companies and organisations
The publication notes that the breach affects a wide range of organisations. In Latvia, text messages from banks "Swedbank" and SEB, insurers "ERGO", "Compensa" and "Artea", the emergency services line 112, the "Porsche" retailer in Latvia, and shopping centres "CityBee", "Barbora" and "Akropolis" were publicly accessible. National airline "airBaltic" was affected across all three Baltic states.
In Lithuania, the breach has impacted "EuroCash", DEPO, "Akropolis", IKI, "PerlasGo", "Autoplius", as well as healthcare companies "Sypsenos akademija" and "Denticija". The DEPO network was affected in Estonia.
Geographical scope
Although "CSCTelecom" operates primarily in Latvia, the consequences of the security flaw have spread more widely — affecting companies and individuals in Lithuania and Estonia as well. The database type — "ClickHouse" — is typically used for processing large volumes of data, and its inadequate protection allowed unauthorised access without special technical skills.
"Cybernews" indicates that the company was notified of the vulnerability following its discovery. Additional information about whether the database has since been secured and whether an investigation has been launched is not yet publicly available.
Source: Diena