The Latvian branch of CSCTelecom, a telecommunications provider, left a database containing over 125 million SMS messages exposed. The leaked records span from October 2022 to September 2026 and were updated in real time, meaning attackers could have intercepted authentication codes, password reset links, and private information before the recipients even saw them.

Our research team discovered the exposed CSCTelecom ClickHouse database on September 28th, 2026. At the time, the service had sent over 3 million SMS messages in September alone.

The database included messages from major banks, medical institutions, popular shopping sites, government organizations, and even Latvia's national emergency hotline, 112. While CSCTelecom operates primarily in Latvia, the leak also affected businesses and individuals in Lithuania and Estonia.

We’ve reached out to CSCTelecom for comment and will update this article once we receive a reply.

What details did the CSCTelecom data leak expose

According to the team, the tens of millions of leaked messages exposed an ocean of data spanning several years.

The leaked database contained:

• Customer business names using CSCTelecom's SMS services
• Phone numbers that messages were sent to
• Complete message contents, including authentication codes, temporary passwords, medical test results, reservation details, shipping updates with names and addresses, travel booking dates, and bank transaction notifications
• Metadata, including timestamps, message prices, and mobile network routing information
• Real-time updates as new messages were sent through the system

The list of impacted businesses spans several sectors. Most notably, major banks and retailers had SMS messages exposed. Some of the household names are recognizable to virtually everyone in the Baltic states:

Exposed businesses and organizations include:

Banks:

• Swedbank (Latvia)
• SEB (Latvia)

Insurance and emergency services:

• ERGO (Latvia)
• 112 Emergency Hotline (Latvia)
• Compensa (Latvia)
• Artea (Latvia)

Retailers and services:

• Porsche (Latvia/Lithuania)
• CityBee (Latvia)
• Barbora (Latvia)
• EuroCash (Lithuania)
• DEPO (Lithuania/Estonia)
• Akropolis (Lithuania/Latvia)
• IKI (Lithuania)
• PerlasGo (Lithuania)
• Autoplius (Lithuania/Latvia)

Healthcare:

• Sypsenos Akademija (Lithuania)
• Denticija (Lithuania)

Travel:

• AirBaltic (Lithuania/Latvia/Estonia)

Major security issue

The key danger ties in to how businesses use SMS services. While leaking marketing messages might spill personal information, leaking one-time codes could spell disaster.

According to the team, authentication codes and password reset links were stored in a publicly accessible database and updated in real time. A malicious actor monitoring the feed could use a 2-factor authentication code or reset a victim's password before the legitimate user even received the message.

Beyond immediate account takeover, the sheer volume and variety of messages create a different kind of threat. With 4 years of SMS history, an attacker can build a detailed profile of nearly anyone in the database: where they shop, which banks they use, when they travel, what medical tests they've had, and how much money they spend.

The variety of sensitive information could be used to build a detailed profile of each phone number user and de-anonymize them,

our research team explained.

Phone numbers that received messages from luxury brands such as Porsche or bank notifications listing high account balances could be used to financially profile victims and prioritize the most lucrative targets for fraud or social engineering attacks.

Even without the message contents, simply knowing which services a phone number is associated with enables highly targeted phishing. An attacker who knows you use Swedbank, shop at Barbora, and have an account with AirBaltic can craft convincing phishing messages impersonating exactly the brands you interact with regularly.

A supply chain nobody thinks about

While CSCTelecom is not a household name, its security lapse may have affected hundreds of services that most people in Latvia, Lithuania, and Estonia use regularly. It's a stark reminder that user data lives with every third-party provider those companies use to send you text messages.

The leak also raises serious questions about GDPR compliance. European data protection law requires companies to retain personal data for no longer than is necessary for the purposes for which it is processed.

Which begs the question: why does an SMS provider need to keep message contents, phone numbers, and metadata for nearly 4 years?

SMS was never secure

This CSCTelecom data leak also reminds us how fundamentally insecure SMS is as a communication channel. Text messages provide no end-to-end encryption and no confidentiality guarantees.

They're vulnerable to SIM swapping attacks, in which an attacker convinces a mobile carrier to transfer your phone number to a SIM card they control, and to SS7 signaling attacks, which let attackers intercept or redirect messages at the network level.

Phone numbers can also be reassigned to new users after a period of inactivity, meaning someone else could eventually receive messages intended for you.

For those looking to improve their security, our researchers recommend opting out of SMS-based authentication and notifications wherever possible. Authenticator apps, in-app notifications, and email-based authentication are all more secure alternatives.

However, many of the services affected by this leak may not offer an alternative, leaving users at the mercy of whatever authentication method the platform decides to support.

What should affected users do?

If you've received SMS messages from any of the affected organizations in the past 4 years, assume that your information has been exposed.

Consider the following steps:

• Change your passwords, especially for banking, email, and any accounts that used SMS-based two-factor authentication.
• Enable app-based 2-factor authentication wherever possible, using authenticator apps like Google Authenticator, Authy, or built-in options from password managers. Watch for phishing attempts that reference specific services you use.
• Monitor your accounts for unauthorized access, especially financial accounts and any service that may have sent you password reset links or authentication codes via SMS.
• Be cautious of unsolicited contact referencing your travel plans, medical appointments, or shopping habits, information that could have been gleaned from the leaked messages.

The 4-year window

The database contained messages dating back to October 20th, 2022, meaning that anyone who found it before our research team did on September 28th, 2026, would have had access to 4 years of private communications. We have no evidence that malicious actors accessed the database, but if our team was able to find it, others may have as well.

The fact that the database was updated in real time is particularly concerning. Unlike a static data breach where stolen information is days or weeks old by the time it's discovered, this leak would have given attackers access to authentication codes and password reset links the moment they were sent, potentially before the intended recipient checked their phone.

Disclosure timeline:

• Leak discovered: September 28th, 2026
• Initial disclosure: September 29th, 2026
• Leak observed closed: October 27th, 2026