A database run by the Latvian branch of the SMS provider CSC Telecom sat open on the internet with more than 125 million text messages sent between October 2022 and September 2026, Cybernews reported on 11 November. The messages came from Swedbank, SEB, airBaltic, Latvia’s 112 emergency line and retailers in all three Baltic states, and new ones appeared as they were queued. Nobody has shown that anyone else read them.

Nothing on the record says money was taken or a bank was breached. The risk is quieter: four years of who texts whom, with phone numbers attached, is a targeting list. It also fits neatly with a second supply of stolen data that already circulates: customer logins harvested by infostealer malware.

In brief

• Cybernews researchers found the open ClickHouse database on 28 September 2026, reported it the next day and found access closed on 27 October. How long it was open before they found it is not known.
• It held sender names, recipients’ phone numbers, the full text of each message and routing metadata, and it updated in real time. More than 3 million messages passed through in September 2026 alone.
• Swedbank has stopped using the provider and opened an investigation. SEB says it used CSC Telecom only for pension-fund information and was not told about the incident. CERT.LV has asked CSC Telecom for an in-depth investigation and passed the case to law enforcement.
• CSC Telecom has not commented publicly. Cybernews says it has no evidence of malicious access.
• The exposure matters most in combination with other stolen data. Phone numbers tied to named services make scam calls and texts far more convincing.

What was exposed?

The provider’s whole sending record: who sent each SMS, to which number, what it said and what it cost. According to Cybernews, the database was a ClickHouse instance reachable without a password, and the message text included one-time codes, temporary passwords, password-reset links, medical test results, bookings, delivery notices with names and addresses, and bank transaction alerts. Swedbank messages carried phone numbers, IBANs, amounts, payment recipients and account balances. airBaltic messages carried surnames and flight details.

CSC Telecom sells bulk SMS to businesses, so each row is a company talking to its own customer. The Latvian company turned over €4.48 million in 2025 and is 89.99% owned by the Estonian-registered Global Telecom Invest, according to Firmas.lv figures cited by Latvian public broadcaster LSM.

Whose messages were in the database?

Banks, insurers, an airline, an emergency service, supermarkets and dental clinics. Cybernews named the senders below; the list is a sample of what its researchers saw, not the provider’s full client book. In Lithuania, the report says, IKI’s messages included phone numbers and authentication codes, DEPO’s carried order numbers and status, EuroCash1’s were security alerts for guarded sites and ATMs, and Akropolis’s included internal figures such as visitor-flow statistics.

Country	Senders named by Cybernews
Latvia	Swedbank, SEB, ERGO, Compensa, Artea, the 112 emergency line, airBaltic, Porsche, CityBee, Barbora, Akropolis, Autoplius
Lithuania	IKI, DEPO, Akropolis, EuroCash1, Perlas Go, Autoplius, Porsche, airBaltic, Šypsenos akademija, Denticija
Estonia	airBaltic, DEPO

What have the companies and authorities said?

The two banks have answered differently, and the provider has not answered at all. Swedbank spokesperson Kristīne Čekstere told the LETA news agency that the bank opened an investigation when it learned of the incident, has stopped using the provider and has asked it for the information needed to judge the impact. SEB said it used CSC Telecom only to send general pension-fund information, gave it nothing but a phone number and the message text, and sent no internet-banking codes, payment details or passwords through it. SEB added that CSC Telecom had not informed it of the incident.

airBaltic said it is assessing the situation with its providers and supervisors and that it is too early to say how many customers are affected. CERT.LV told LETA it has asked CSC Telecom to investigate in depth, offered help and passed the information to law enforcement. In the Lithuanian coverage we reviewed by the evening of 11 November, none of the Lithuanian companies named had commented, and neither had Lithuania’s data protection inspectorate or its National Cyber Security Centre.

Could someone have read the messages as they were sent?

Technically yes, and that is the part that separates this from an old archive left on a server. Kirils Solovjovs, who heads the Latvian security firm Possible Security, told Latvian Radio that the system appears to have been exposed by accident and poorly configured, that anyone could browse it read-only, and that a message was visible as soon as it entered the sending queue. A one-time code or reset link could in principle have been read before the phone it was sent to lit up.

In principle is as far as the evidence goes. Cybernews says it has no sign of malicious access, Solovjovs says it is unclear whether anyone took the data, and CSC Telecom has published no access logs or findings. Unauthenticated ClickHouse databases do get found: Wiz researchers located DeepSeek’s open ClickHouse instance within minutes of looking in January 2025. Until the provider says how long this one was reachable and who connected to it, the safe assumption for the companies involved is that the messages were read.

How do stealer logs make this worse?

They supply the other half of a fraud kit. An SMS archive tells a criminal that a given phone number banks with one company, shops with another and flew last month. Infostealer malware runs on people’s own infected computers and harvests the usernames, passwords and session cookies they use on customer portals, and those logs are traded in bulk. Customer accounts at large consumer brands turn up in them routinely, in the Baltics as everywhere else.

That describes infected customer devices, not a breach of any company named in the report, and a bank login captured by malware still has to get past strong authentication such as Smart-ID. It matters here because the two data sets fit together. The Baltic states had the lowest employee exposure in our November infostealer report, and even there 71% to 75% of large organisations had at least one stolen staff login, against 89.6% across the 36-country panel. A caller who knows your bank, your last delivery and your phone number is more convincing than one who knows none of it.

Why was four years of SMS still there?

Nobody has explained it, and it is the question regulators are likeliest to ask. The GDPR’s storage-limitation rule, Article 5(1)(e), says personal data may be kept no longer than the purpose requires. A one-time code has served its purpose within minutes, and a delivery notice within days. Voldemaras Kadys, head of security and platform engineering at Cybernews’s publisher, raised that rule in the report, alongside the risk that so long a history lets criminals profile individuals and tailor fraud to them.

The second question is notification. Under Article 33(2) a processor must tell the companies it works for about a personal data breach without undue delay. Cybernews says it reported the exposure on 29 September; SEB says that six weeks later it had heard nothing from the provider. Swedbank has not said when it was told. Whether an exposure with no proven outside access obliges a processor to notify is for the data protection authorities in Riga, Vilnius and Tallinn to decide, and none had commented in the coverage we reviewed.

What should customers and companies do now?

Assume the texts were read, and stop treating knowledge of your details as proof of identity. For anyone in the Baltics who gets SMS from these senders:

• Do not act on a call, text or email because the sender knows your bank, a recent payment, a booking or an address. Hang up and contact the company through its own app or website.
• Never approve a Smart-ID, Mobile-ID or eParaksts request you did not start, and never type a PIN after following a link.
• Change any password you last set through a temporary password or reset link that arrived by SMS.
• Where a service offers an authenticator app or Smart-ID in place of SMS codes, switch.

For companies that send SMS through an aggregator:

• Ask the provider in writing how long it keeps message bodies and who can query them, and put a retention limit in the processing agreement.
• Keep balances, IBANs, names and addresses out of SMS. A notification that says “you have a new transaction, open the app” leaks nothing.
• Send one-time codes through a channel you control, or make sure the aggregator deletes them on delivery.
• Check how many of your customers’ and employees’ logins are already circulating in stealer logs, and force resets on the ones that are.

Frequently asked questions

Sources and further reading

• Cybernews: Huge European telecom leak exposes Swedbank, SEB, airBaltic and dozens of other companies’ clients (11 November 2026)
• SEB Latvia: statement on the CSC Telecom security incident (11 November 2026)
• LSM: statements from Swedbank, SEB, airBaltic, CERT.LV and Kirils Solovjovs (11 November 2026)
• nra.lv: discovery and closure dates (11 November 2026)
• Wiz Research: exposed DeepSeek ClickHouse database (January 2025)
• Related: the November 2026 infostealer report and the Registrų centras breach

Reporting by the Ransomnews Research Team. Ransomnews did not access the exposed database; details of its contents are as reported by Cybernews. No messages or credentials are reproduced.