Latvian SMS provider exposed 125 million texts with login codes and bank alerts

The Latvian branch of CSCTelecom, a company that sends text messages on behalf of businesses, left a database of more than 125 million SMS messages open to anyone on the internet. Cybernews reported on 11 November that the messages date from October 2022 to September 2026 and include one-time login codes, password reset links, bank alerts and flight details sent to people in Latvia, Lithuania and Estonia. The database was updated in real time, so anyone watching it could see a code at the same moment it reached the recipient's phone.

What was in the messages

The database ran on ClickHouse and held the full text of each message, the name of the business that sent it, timestamps, the price of each message and mobile network routing data. Cybernews lists authentication codes, temporary passwords, medical test results, reservation details, delivery updates with names and addresses, travel dates and bank transaction notices.

Swedbank messages showed IBAN account numbers, transaction amounts, recipients, remaining balances and, in some cases, the shop where a purchase was made. Messages from the insurer ERGO contained document numbers, vehicle registration numbers and invoice amounts. Records linked to the 112 emergency line showed phone numbers and case details. airBaltic messages contained flight details and passengers' surnames, and the car-sharing service CityBee and the Lithuanian supermarket chain IKI sent login codes through the gateway.

The list of senders also includes the insurers Compensa and Artea, Porsche, the online grocery Barbora, EuroCash, DEPO, the Akropolis shopping centres, PerlasGo, Autoplius and two Lithuanian healthcare providers. LRT notes that EuroCash1 messages included security alerts about guarded premises and ATMs.

Why login codes by SMS are the weak spot

A live feed of one-time codes is the most dangerous part. An attacker who already had someone's password and watched the database could enter the code or open a reset link before the real user even looked at their phone. Four years of history also make it possible to build a profile of a phone number's owner: which bank they use, where they shop, when they fly and how much they spend.

Voldemaras Kadys, head of security and platform engineering at Mediatech, which owns Cybernews, told LRT that even without the message text, knowing which services a number is linked to is enough for targeted fraud. A fake text that looks like it comes from your own bank or airline is far more convincing. He also said the case raises questions under the GDPR, which requires companies to keep personal data only as long as needed.

What the companies say

CSCTelecom had not replied to Cybernews by the time of publication. SEB Latvia said it uses CSCTelecom only "to a limited extent" for marketing about pension funds, sends sensitive information through other channels, and had not been told about the incident by the provider. airBaltic said it was assessing the situation with the provider and that it was too early to say how many customers were affected. It advised customers to be wary of messages, emails and calls that claim to be from the airline and ask for urgent action, links or personal data. PerlasGo said it was also assessing the situation.

What to do if you live in the Baltics

• If you received texts from any of these companies in the past four years, assume your number and the services linked to it are known to others.
• For banking and email, switch from SMS codes to an authenticator app or in-app confirmation where the service offers it.
• Change passwords on accounts that used SMS codes or SMS reset links.
• Treat calls and messages that mention your flights, orders, medical appointments or bank transfers with suspicion, and check them through the official app or website.