Back Cybernews Huge leak exposes Swedbank, SEB, airBaltic and other companies' clients
The Latvian branch of CSCTelecom, a telecommunications provider, left a database containing over 125 million SMS messages exposed. The leaked records span from October 2022 to September 2026 and were updated in real time, meaning attackers could have intercepted authentication codes, password reset links, and private information before the recipients even saw them.
Our research team discovered the exposed CSCTelecom ClickHouse database on September 28th, 2026. At the time, the service had sent over 3 million SMS messages in September alone.
The database included messages from major banks, medical institutions, popular shopping sites, government organizations, and even Latvia's national emergency hotline, 112. While CSCTelecom operates primarily in Latvia, the leak also affected businesses and individuals in Lithuania and Estonia.
We’ve reached out to CSCTelecom for and will update this article once we receive a .
What details did the CSCTelecom data leak expose
According to the team, the tens of millions of leaked messages exposed an ocean of data spanning several years.
The leaked database contained:
Customer business names using CSCTelecom's SMS services
Phone numbers that messages were sent to
Complete message contents, including authentication codes, temporary passwords, medical test results, reservation details, shipping updates with names and addresses, travel booking dates, and bank transaction notifications
Metadata, including timestamps, message prices, and mobile network routing information
Real-time updates as new messages were sent through the system
The list of impacted businesses spans several sectors. Most notably, major banks and retailers had SMS messages exposed. Some of the household names are recognizable to virtually everyone in the Baltic states:
Exposed businesses and organizations include:
Insurance and emergency services:
112 Emergency Hotline (Latvia)
Check if your data was exposed
Find out if your email and related personal information have appeared in known data breaches.
Retailers and services:
Sypsenos Akademija (Lithuania)
Denticija (Lithuania)
AirBaltic (Lithuania/Latvia/Estonia)
The key danger ties in to how businesses use SMS services. While leaking marketing messages might spill personal information, leaking one-time codes could spell disaster.
According to the team, authentication codes and password reset links were stored in a publicly accessible database and updated in real time. A malicious actor monitoring the feed could use a 2-factor authentication code or reset a victim's password before the legitimate user even received the message.
Beyond immediate account takeover, the sheer volume and variety of messages create a different kind of threat. With 4 years of SMS history, an attacker can build a detailed profile of nearly anyone in the database: where they shop, which banks they use, when they travel, what medical tests they've had, and how much money they spend.
The variety of sensitive information could be used to build a detailed profile of each phone number user and de-anonymize them, our research team explained.
Phone numbers that received messages from luxury brands such as Porsche or bank notifications listing high account balances could be used to financially profile victims and prioritize the most lucrative targets for fraud or social engineering attacks.
Even without the message contents, simply knowing which services a phone number is associated with enables highly targeted phishing. An attacker who knows you use Swedbank, shop at Barbora, and have an account with AirBaltic can craft convincing phishing messages impersonating exactly the brands you interact with regularly.
A supply chain nobody thinks
While CSCTelecom is not a household name, its security lapse may have affected hundreds of services that most people in Latvia, Lithuania, and Estonia use regularly. It's a stark reminder that user data lives with every third-party provider those companies use to send you text messages.
The leak also raises serious questions GDPR compliance. European data protection law requires companies to retain personal data for no longer than is necessary for the purposes for which it is processed.
Which begs the question: why does an SMS provider need to keep message contents, phone numbers, and metadata for nearly 4 years?
This CSCTelecom data leak also reminds us how fundamentally insecure SMS is as a communication channel. Text messages provide no end-to-end encryption and no confidentiality guarantees.
They're vulnerable to SIM swapping attacks, in which an attacker convinces a mobile carrier to transfer your phone number to a SIM card they control, and to SS7 signaling attacks, which let attackers intercept or redirect messages at the network level.
Phone numbers can also be reassigned to new users after a period of inactivity, meaning someone else could eventually receive messages intended for you.
For those looking to improve their security, our researchers recommend opting out of SMS-based authentication and notifications wherever possible. Authenticator apps, in-app notifications, and email-based authentication are all more secure alternatives.
However, many of the services affected by this leak may not offer an alternative, leaving users at the mercy of whatever authentication method the platform decides to support.
What should affected users do?
If you've received SMS messages from any of the affected organizations in the past 4 years, assume that your information has been exposed.
Consider the following steps:
Change your passwords, especially for banking, email, and any accounts that used SMS-based two-factor authentication.
Enable app-based 2-factor authentication wherever possible, using authenticator apps like Google Authenticator, Authy, or built-in options from password managers. Watch for phishing attempts that reference specific services you use.
Monitor your accounts for unauthorized access, especially financial accounts and any service that may have sent you password reset links or authentication codes via SMS.
Be cautious of unsolicited referencing your travel plans, medical appointments, or shopping habits, information that could have been gleaned from the leaked messages.
The database contained messages dating back to October 20th, 2022, meaning that anyone who found it before our research team did on September 28th, 2026, would have had access to 4 years of private communications. We have no evidence that malicious actors accessed the database, but if our team was able to find it, others may have as well.
Curious what others think this story? Contribute your thoughts to the debate below.
The fact that the database was updated in real time is particularly concerning. Unlike a static data breach where stolen information is days or weeks old by the time it's discovered, this leak would have given attackers access to authentication codes and password reset links the moment they were sent, potentially before the intended recipient checked their phone.
What do impacted organizations say?
We have reached out to organizations whose data was included in the leaking database. Representatives of SEB Latvia told us that the company “uses CSC Telecom’s services only to a limited extent for sending marketing communications related to pension funds.”
“SEB uses other communication channels for sending sensitive customer information. CSC Telecom has not informed SEB the security incident, so we are currently assessing the situation based on the information available to us,” the bank said.
Meanwhile, AirBaltic said the company has initiated an assessment of the situation and is closely working with the service provider to verify information and clarify potential impact of the incident.
“As the assessment is still ongoing, it would be premature to draw any conclusions regarding the potential scope of the data affected or the number of customers involved. Based on the findings of the assessment, the necessary measures will be taken to protect customers’ interests and ensure data security,” the company said.
AirBaltic advised customer to stay vigilant text messages, emails or phone calls that appear to come from the airline, especially if contents of the text demand urgent action, invites to open links, or personal data.
PerlasGo also explained that the company is currently assessing the situation. The company said it had no confirmed information its data leaking, and could not say whether any of the company's customers' data was exposed.
At the same time, Artea Life Insurance replied saying that the company reached out to the service provider.
“On 11 November 26, in response to our enquiry, CSC Telecom provided a general statement confirming a security incident related to an identified access configuration vulnerability that could have allowed unauthorised access to its SMS platform database,” the company said.
Artea Life Insurance explained that the company used CSCTelecom as a SMS service provider. CSCTelecom told the company that the flaw has been resolved, and the technical checks conducted so far have not identified signs of an attack or evidence of data misuse.
“We have suspended all use of CSC Telecom’s services and are conducting an internal investigation to determine whether and to what extent our customers may have been affected,” Artea Life Insurance said.
The company reassured that it takes processing and protection of personal data "very seriously.”
“In particular, SMS messages sent through this platform did not contain customers’ names, personal identification numbers or special categories of personal data. However, other information associated with these communications may still constitute personal data,” the company explained.
Artea Life Insurance advised customers to remain vigilant of unexpected SMS messages, especially those requesting money transfers, containing suspicious links or asking for personal details.
“We are seeking further information from the service provider and assessing the potential impact of the incident on our customers. We will inform our customers the incident and provide precautionary advice,” the company said.
Leak discovered: September 28th, 2026
Initial disclosure: September 29th, 2026
Leak observed closed: October 27th, 2026
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
