internet-exposed-servicemass-credential-exposurecommunication-services-sector-threatthird-party-vendor-breach

CSC Telecom Exposes 125 Million Baltic SMS Messages in Unsecured Database

Attack Surface Exposure · 2 sources · Updated 6h ago · First seen Nov 11, 2026

CSC Telecom’s Latvian branch exposed an unauthenticated ClickHouse database containing more than 125 million SMS messages from organizations across Latvia, Lithuania and Estonia, including Swedbank, SEB and airBaltic. Messages dated from October 2022 through September 2026 included phone numbers, authentication codes, password-reset links, financial information, medical results and travel details. Cybernews discovered the database on September 28, 2026, reported it the following day and observed that it continued updating in real time. Access was found closed on October 27.

The exposure could have enabled account takeover, targeted phishing and detailed profiling, but no malicious access or resulting financial theft has been established. According to Artea Life Insurance, CSC Telecom confirmed an access-configuration vulnerability, said it had resolved the issue and reported no signs of attack or misuse in technical checks. Swedbank stopped using the provider and opened an investigation; CERT.LV requested an in-depth investigation and referred information to law enforcement. Ransomnews separately identified 3,523 infostealer-captured customer logins across ten sender domains, but established no connection to the SMS exposure. The incident raises concerns about sensitive-message retention, third-party access controls and notification of affected organizations.

Is this exposed in your estate?Map this exposure pattern across your cloud, code, and identities.

Map your surface

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

12 events · Sep 28, 2026 – Nov 11, 2026

Reported Nov 11, 20269h ago
CERT.LV requests an investigation and refers information to law enforcement
CERT.LV requested an in-depth investigation from CSC Telecom and offered assistance. It also forwarded information about the exposure to law enforcement.
CSC Telecom SMS leak: 125 million Baltic texts exposed, what we know | Ransomnews
Reported Nov 11, 20269h ago
Swedbank stops using CSC Telecom and opens an investigation
Swedbank said it had stopped using CSC Telecom, opened an investigation and requested information needed to assess the impact. Exposed Swedbank-related messages included phone numbers, IBANs, transaction amounts, payment recipients and account balances.
CSC Telecom SMS leak: 125 million Baltic texts exposed, what we know | Ransomnews
Reported Nov 11, 202617h ago
PerlasGo begins assessing possible data exposure
PerlasGo said it was assessing the situation and had no confirmed information establishing whether its own data or customer data had leaked.
Huge leak exposes Swedbank, SEB, airBaltic and other companies’ clients | Cybernews
Reported Nov 11, 202617h ago
AirBaltic investigates the exposure and warns customers about suspicious messages
AirBaltic said it was assessing the incident with its providers and supervisors but could not yet determine the affected data scope or customer count. It advised customers to be cautious of purported airline messages demanding urgent action, directing them to links or requesting personal information.
Huge leak exposes Swedbank, SEB, airBaltic and other companies’ clients | Cybernews
Reported Nov 11, 202617h ago
SEB says it received no incident notification from CSC Telecom
SEB Latvia said CSC Telecom had not informed it about the incident and that it was assessing available information. The bank said it used the provider only for general pension-fund communications, not internet-banking codes, payment details or passwords.
Huge leak exposes Swedbank, SEB, airBaltic and other companies’ clients | Cybernews
Reported Nov 11, 202617h ago
Artea suspends CSC Telecom services and investigates customer impact
Artea Life Insurance suspended all use of CSC Telecom’s services and began an internal investigation into whether and to what extent customers were affected. It said its SMS messages did not contain customer names, personal identification numbers or special-category personal data, while acknowledging that other communication information could constitute personal data.
Huge leak exposes Swedbank, SEB, airBaltic and other companies’ clients | Cybernews
Nov 11, 20261d ago
Separate credential research identifies 3,523 logins across ten sender domains
Ransomnews queried the Alerts.bar index and identified 3,523 infostealer-captured customer logins across ten domains associated with SMS senders. These credentials came from infected customer devices, and the research established no connection to the SMS exposure or evidence that attackers combined the datasets.
CSC Telecom SMS leak: 125 million Baltic texts exposed, what we know | Ransomnews
Nov 11, 20261d ago
CSC Telecom confirms an access-configuration flaw to Artea
According to Artea Life Insurance, CSC Telecom confirmed that an access-configuration vulnerability could have allowed unauthorized access to its SMS platform database. The provider said the flaw had been resolved and technical checks had found no signs of an attack or data misuse.
Huge leak exposes Swedbank, SEB, airBaltic and other companies’ clients | Cybernews
Nov 11, 20261d ago
Cybernews publishes findings identifying affected organizations and exposed data
Cybernews published findings identifying messages associated with Swedbank, SEB, airBaltic, insurers, medical providers, retailers and Latvia’s 112 emergency hotline. Exposed contents included authentication codes, password-reset links, bank transaction details, medical results and travel information.
Huge leak exposes Swedbank, SEB, airBaltic and other companies’ clients | Cybernews
Oct 27, 202616d ago
Researchers observe that public access to the database has closed
Cybernews researchers found that access to the exposed database had been closed. Researchers reported no evidence of malicious access.
Huge leak exposes Swedbank, SEB, airBaltic and other companies’ clients | Cybernews
Sep 29, 20261mo ago
Cybernews initially reports the SMS database exposure
Cybernews’s disclosure timeline records its initial report of the exposed CSC Telecom database. The records included complete message contents, recipient phone numbers, timestamps and routing information.
Huge leak exposes Swedbank, SEB, airBaltic and other companies’ clients | Cybernews
Sep 28, 20262mo ago
Cybernews discovers exposed database containing over 125 million SMS messages
Cybernews researchers discovered a publicly accessible, unauthenticated ClickHouse database operated by CSC Telecom’s Latvian branch. It contained financial, medical, travel and authentication messages involving organizations and individuals across the Baltic states and continued updating in real time; when public exposure began remains unknown.
Huge leak exposes Swedbank, SEB, airBaltic and other companies’ clients | Cybernews

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Affected products

1 linked

Clickhouse

Organizations

23 linked

SwedbankPorscheSkandinaviska Enskilda BankenCityBeeDEPOairBalticArteaIKIAkropolisEuroCash1+13 more

Breaches

19 linked

AIRBALTIC-2026-11IKI-2026-11SEB-2026-11DEPO-2026-11CSCTELECOM-2026-11EUROCASH1-2026-11AKROPOLIS-2026-11SWEDBANK-2026-11AKROPOLIS-2026-09AIRBALTICCORPORATIONAS-2026-09+9 more

Do you run this?See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.

See Where You're Exposed

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

RansomnewsNews · Nov 11, 2026

CSC Telecom SMS leak: 125 million Baltic texts exposed, what we know | RansomnewsOpen source ↗

CybernewsNews · Nov 11, 2026

Huge leak exposes Swedbank, SEB, airBaltic and other companies’ clients | CybernewsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News