More than 125 million text messages, including bank notifications, authentication codes, and flight details, sat in a publicly accessible database managed by the telecommunications firm CSC Telecom’s Latvian branch, with the telecommunications company owned by Estonia-registered Osauhing Global Telecom Invest (89,99%) and Sergejs Buzaks (10,01%).
Researchers discovered the unprotected database on September 28, according to [Cybernews].
The exposed logs spanned from October 2022 to September 2026 and updated in real time. This structure meant malicious actors could potentially intercept one-time passwords and account recovery links before the intended recipients saw them, [Kursors.lv] reported.
Impacted organizations included Swedbank, SEB, and airBaltic, alongside retail chains and Latvia’s emergency response line 112.
The leak affected users and companies across Latvia, Lithuania, and Estonia, with affected clients also encompassing ERGO, Compensa, and Artea in Latvia, Porsche in Latvia and Lithuania, CityBee and Barbora in Latvia, EuroCash in Lithuania, DEPO in Lithuania and Estonia, Akropolis in Latvia and Lithuania, IKI, PerlasGo, and Autoplius in Lithuania and Latvia, and airBaltic across all three Baltic states.
Companies respond to the security lapse and investigation
Financial institutions and transport companies moved quickly to evaluate their exposure once researchers flagged the security lapse. CSC Telecom closed public access to the database on October 27, almost a month after researchers initially found it. Swedbank suspended its use of the telecommunications provider immediately. The bank requested detailed information to determine the full scope of the incident. “Our priority right now is to fully assess the incident and ensure the protection of our clients’ interests and data,” said Kristīne Čekstere, a Swedbank representative, to [LETA]. SEB bank said that its systems and sensitive customer funds remained secure.
SEB used CSC Telecom’s services only on a limited scale for marketing messages related to pension funds. “CSC Telecom has not informed SEB about the security incident, so the bank is currently evaluating the situation based on the information it has,” said Anete Igaune, SEB bank representative, to LETA.
AirBaltic also initiated an internal review. The airline urged travelers to remain cautious of unexpected messages regarding bookings. “The evaluation is ongoing, so it would be premature to draw conclusions about the amount of data or the number of customers that may have been affected,” airBaltic representatives stated to LETA.
Cert.lv requests investigation into technical risks
Latvian cybersecurity incident response authority Cert.lv requested a comprehensive investigation from CSC Telecom. The agency offered technical support and referred the findings to law enforcement authorities. “In this case, the impact is quite broad. We are talking about service providers who have chosen to either directly or indirectly cooperate with a service provider that delivers text messages to the operator,” a cybersecurity expert stated to [LSM].
Researchers have not confirmed any active exploitation or data theft from the database. CSC Telecom reported a turnover of 4,483,000 euros and a profit of 110,554 euros in 2025, according to Firmas.lv data cited by [nra.lv].
Questions about the database breach and exposed details
Did the database breach result in stolen money from bank accounts?
No evidence confirms any unauthorized financial transactions or direct account takeovers resulting from this specific database exposure.
Which countries were affected by the text message exposure?
The misconfigured database contained records affecting businesses and individuals in Latvia, Lithuania, and Estonia.
What specific details were visible in the exposed Swedbank messages?
Exposed bank notices included phone numbers, IBAN account numbers, transaction amounts, recipient details, and account balances.
Related reading