Cybernews reports exposure of 125 million text messages

More than 125 million text messages sent by banks and other organisations may have been exposed through a database linked to telecoms provider CSCTelecom, the online publication Cybernews reported. LSM said SEB Bank stated that sensitive customer data, funds and the bank’s systems were not affected, while Swedbank urged customers to remain vigilant.

Cybernews reported that a security flaw left the database publicly accessible. It contained messages sent between October 2022 and September 2026 and was updated in real time, potentially allowing attackers to intercept authentication codes, password-reset links and private information before recipients saw the messages.

The database was discovered by Cybernews researchers in late September. In September alone, CSCTelecom had sent more than three million messages, the publication reported. The database included messages from major banks, medical institutions, popular shopping websites, government organisations and Latvia’s emergency number 112. The LSM summary also listed insurers and airBaltic among the organisations whose messages may have been exposed.

Information available in the database included client company names, recipient phone numbers and full message contents. These could include authentication codes, temporary passwords, medical test results, booking details, delivery updates containing names and addresses, travel booking dates and bank transaction notifications. Metadata such as timestamps, message prices and mobile network routing information was also exposed.

Although CSCTelecom mainly operates in Latvia, the reported leak also affected companies and individuals in Lithuania and Estonia.