Potential CSC Telecom leak exposes 125 million text messages across Baltics
More than 125 million text messages may have leaked from the Latvian branch of telecom provider CSC Telecom, potentially affecting people and businesses across the Baltics.
The unsecured database, discovered by Latvian outlet Cybernews on Clickhouse on September 28, contained messages dating from October 2022 through September 2026, including more than 3 million messages sent this September alone.
The database contained full message contents, customer names, phone numbers and metadata such as timestamps, with exposed information including temporary passwords, medical test results, booking details, delivery addresses, travel reservations and bank notifications.
Because it was updated in real time, attackers may have been able to access messages before they reached recipients.
From big banks to airBaltic and CityBee
Cybernews identified text messages from Latvia's Swedbank and SEB, insurers ERGO, Compensa and Artea, the emergency number 112 and businesses across Estonia, Latvia and Lithuania, including Porsche dealerships, shared mobility platform CityBee, online grocery service Barbora, home improvement chain DEPO and the Latvian airline airBaltic.
Swedbank Latvia spokesperson Kristīne Čekstere told news agency LETA that the bank immediately launched an investigation and took all legally required measures after learning of the incident.
The bank has suspended its use of CSC Telecom's services and requested information to assess the scale and potential impact of the breach. It urged customers to be wary of suspicious messages, calls and emails requesting personal information or authentication codes.
"Our priority at present is to fully assess the incident and ensure the protection of our customers' interests and data," said Čekstere.
SEB: Our sensitive customer data not at risk
SEB spokesperson Anete Igaune told LETA that their bank used CSC Telecom only to send limited marketing messages related to pension funds, stressing that sensitive customer information is transmitted through other channels and that SEB's systems, sensitive customer data and clients' funds are not at risk.
She said CSC Telecom has not notified SEB of a security incident.
"We are currently assessing the situation based on the information at our disposal," Igaune noted.
AirBaltic said it was aware of reports of a possible data security incident involving an external service provider and was working with providers and regulators to assess its potential impact.
The airline said it was too early to determine how much data may have been exposed or how many customers could be affected. It urged passengers to be cautious of messages or calls requesting urgent action, payment details or login credentials.
Latvian CERT wants answers
Latvia's cybersecurity incident response agency CERT.lv told LETA it had asked CSC Telecom to investigate and establish whether there was evidence of a data breach from the company's infrastructure. The agency offered the company its assistance and forwarded its information on to law enforcement.
Founded in Toronto in 1995, telecommunications provider CSC Telecom expanded into the Baltics in 1998 and is now a leading landline provider in the region.
According to Latvian business database Firmas.lv, CSC Telecom SIA reported revenue of €4.48 million and a profit of €110,554 in 2025.
Registered in 2022, the company is 89.99 percent owned by Estonian-based Global Telecom Invest and 10.1 percent by Sergejs Buzaks (Sergei Buzak).
--
Editor: Mait Ots, Aili Vahtla
