An SMS data breach involving CSCTelecom exposed more than 125 million messages sent across the Baltic states. The unsecured database included one-time codes, password-reset links, medical information and financial notifications.
The exposure was discovered on 28 September 2026, but it only became public when Cybernews published its investigation on 11 November 2026. Although CSCTelecom says it found no evidence that the records were downloaded, CERT.LV has said criminal access cannot yet be ruled out.
How the SMS data breach was discovered
Researchers found a ClickHouse database used by the Latvian branch of CSCTelecom accessible over the public Internet without authentication. CSCTelecom operates a business messaging platform that sends application-to-person SMS communications on behalf of banks, emergency services, insurers, airlines, retailers and other organisations.
The database contained more than 125 million SMS records dating from October 2022 to September 2026. Rather than holding only historical logs, it was updating in real time as messages were queued and delivered.
Researchers could see complete message contents alongside associated metadata. The exposed fields reportedly included recipient telephone numbers, sender identifiers, timestamps, mobile network routing information and the cost of individual messages.
This combination made the SMS data breach particularly sensitive. Someone accessing the database could potentially have connected a message to its recipient, identified the sending organisation and read its contents as it moved through the messaging platform.
Messages and organisations affected
The exposed messages covered several categories of confidential or time-sensitive communication. Reported examples included:
- One-time authentication codes and temporary passwords
- Password-reset links for online accounts
- Bank transaction and account notifications
- Medical test results and health-related messages
- Travel reservations and booking details
- Delivery addresses and retail notifications
National media named senders including Swedbank, SEB, Latvia’s 112 emergency service, ERGO, Compensa, Artea, airBaltic, Barbora, CityBee, DEPO, Akropolis, Autoplius and Porsche dealerships. Inclusion in the database does not establish that every customer of each organisation was affected, but it shows the range of services using the platform.
Why real-time access increased the risk
The database exposure was caused by an Internet-accessible ClickHouse instance that did not require authentication. No software version numbers have been published, and reports describe a configuration or access control failure rather than the exploitation of a named ClickHouse vulnerability.
Real-time access is an important aspect of the incident. Many SMS codes and reset links are valid only briefly, so historical exposure may limit their immediate usefulness. Visibility at the moment of transmission could instead allow an unauthorised party to capture a code while it remained active.
An SMS code alone would not always be sufficient to compromise an account. An attacker might also need a password, account identifier or other information. However, the exposed telephone numbers, sender names and message contents could support targeted account takeover attempts, social engineering or convincing smishing messages.
For example, a criminal who knew that a recipient had just received a genuine bank notification or delivery message could impersonate that organisation with greater credibility. Medical, travel and address information could also create privacy and physical security concerns unrelated to account access.
No technical indicators of compromise have been published. There are no reported IP addresses, domains, file hashes or database paths that organisations can use to determine whether a third party accessed the exposed system.
SMS data breach timeline and response
The records show that the database retained messages over an extended period, while the discovery and remediation process took place between September and October 2026. The confirmed timeline is:
- October 2022: The earliest records contained in the database were created.
- 28 September 2026: The Cybernews research team discovered the exposed ClickHouse database.
- 29 September 2026: CSCTelecom was notified about the vulnerability.
- 27 October 2026: The database was closed and was no longer publicly accessible.
- 11 November 2026: Cybernews published its investigation into the exposure.
- 12 November 2026: Estonian and Latvian public broadcasters reported responses from affected organisations.
- 13 November 2026: Latvian public broadcaster LSM reported that authorities had opened investigations.
CSCTelecom acknowledged that a security vulnerability had existed and said it had been fixed. The company reported the incident to CERT.LV and began an in-depth security audit. Its preliminary investigation found no evidence that data had been downloaded from the database.
That conclusion is not yet definitive. CERT.LV said it was not possible to confirm with certainty that criminals had not accessed the records. The Latvian State Police and Data State Inspectorate have also begun investigations.
Responses from banks and regional operations
Swedbank Latvia suspended its use of CSCTelecom while the incident was investigated. CSCTelecom Estonia stated that its Estonian messaging service operates on separate servers and a separate database, and was therefore unaffected.
SEB similarly said that customer data belonging to its Estonian branch had not leaked. These statements narrow the known geographical impact but do not change the findings concerning the Latvian platform.
Current exploitation status
As of 13 November 2026, there was no confirmed evidence that threat actors had extracted or criminally used data from the exposed database. No attacker or criminal group has been linked to the SMS data breach, and the available reporting points to an unsecured system rather than a targeted intrusion.
However, an absence of confirmed exfiltration is not proof that the database was never viewed or copied. Because it was reachable without authentication, access may not have produced the same evidence expected from an attack involving stolen credentials or malware. The official investigations will therefore be central to determining the full impact.
What organisations should do now
Organisations using third-party SMS platforms should establish whether their supplier retained message contents and whether any data passed through CSCTelecom’s Latvian infrastructure. They should also review authentication and account recovery activity for unusual requests associated with the exposure period.
- Ask SMS providers how message databases are authenticated, monitored and exposed to the Internet.
- Confirm retention periods for message bodies, recipient numbers and delivery metadata.
- Prioritise authenticator apps, passkeys or hardware security keys for critical accounts.
- Monitor for suspicious password resets, authentication attempts and targeted smishing.
- Warn potentially affected users not to share codes or follow unexpected account-recovery links.
The incident demonstrates that SMS security depends not only on mobile networks and recipient devices, but also on the intermediary platforms processing each message. Where messages contain active credentials or sensitive personal information, an exposed supplier database can turn a routine notification channel into a significant source of risk.
Originally reported by Escudo Digital.
