A telecommunications provider operating in Latvia exposed more than 125 million text messages through an unsecured database, potentially compromising sensitive communications from banks, healthcare providers, retailers, and public institutions across the Baltic states. The records included authentication codes, financial transactions, medical information, and personal contact details.
The exposure involved CSCTelecom, a company providing business messaging services to organizations in Latvia, Lithuania, and Estonia. Security researchers discovered the publicly accessible ClickHouse database on September 28, 2026, finding records dating from October 2022 through September 2026.
Unlike an ordinary historical data leak, the database was receiving new messages in real time. More than three million SMS messages had been processed during September alone, meaning anyone with access could potentially monitor incoming communications as they were transmitted.
The exposed information included recipient telephone numbers, complete message contents, sending timestamps, customer organization names, and mobile network routing details. Some records also contained message delivery costs and other operational metadata.
Among the affected organizations were the Latvian operations of Swedbank and SEB. Messages associated with Swedbank contained bank account numbers, transaction amounts, payment recipients, remaining balances, and details identifying certain purchases.
Other exposed communications included one-time authentication codes, temporary passwords, and account verification messages. Such information could potentially allow criminals to access online accounts if they intercepted valid codes while initiating or exploiting an authentication process.
The database also contained messages associated with Latvia’s 112 emergency service, including telephone numbers and incident details. Insurance providers such as ERGO and Compensa were represented, with some communications revealing policy-related information, vehicle registration numbers, and invoice amounts.
Several Lithuanian businesses appeared in the exposed records, including IKI, Akropolis, PerlasGo, Autoplius, and EuroCash. The information ranged from customer verification codes and purchase updates to security notifications concerning protected properties.
Travel-related messages from airBaltic contained passenger contact details, flight information, and surnames. Healthcare organizations, including Lithuanian dental clinics, were also affected, with some records revealing medical test information and appointment-related communications.
The incident raises concerns beyond the immediate exposure of individual messages. Combining several years of communications associated with a single telephone number could reveal a person’s banking relationships, shopping habits, travel arrangements, healthcare interactions, and financial circumstances.
Researchers also warned that the real-time nature of the exposure created opportunities for account takeover. Criminals monitoring incoming authentication codes or password reset links could potentially exploit them before their intended recipients completed the relevant security procedures.
The researchers notified CSCTelecom about the exposed database on September 29. They subsequently confirmed that public access had been closed by October 27, nearly one month after the initial discovery.
However, the investigation has not established whether malicious actors accessed or downloaded the information before the database was secured. There is currently no confirmed evidence that the exposed messages were used to compromise customer accounts.
The incident also raises questions about why the messaging provider retained years of communications containing sensitive personal information. Under European data protection rules, organizations must limit personal data retention to periods justified by legitimate processing purposes.