CSC Telecom fixes flaw exposing more than 125 million text messages

Telecommunications company CSC Telecom has fixed a security flaw in a database containing more than 125 million text messages sent to customers in Latvia and Lithuania, LSM reported. Latvia’s State Police and Data State Inspectorate have begun checking the incident.

The messages, sent over four years by banks, insurers, retailers and service providers, were accessible to unauthorised people. The database also contained customers’ phone numbers. There is no indication so far that the information was misused, but it cannot be ruled out that someone obtained it.

Cybersecurity news outlet CyberNews journalists discovered the vulnerability. They reported that attackers might have been able to intercept authentication codes, password-reset links and other private information before recipients read the messages. Screenshots published by the outlet included a Swedbank password-reset verification code, transaction details and an account balance.

Swedbank and SEB were among the companies using CSC Telecom to send messages, along with insurers ERGO, Compensa and Artea; service providers Barbora, CityBee, Porsche, DEPO, Akropolis and Autoplius; and airline airBaltic.

Banks said there was no risk to customers’ funds or online banking. Companies urged customers to assess incoming text messages carefully. A cybersecurity expert recommended signing up for notifications through apps rather than receiving them by text.