CSC Telecom closes exposed SMS database as Latvian police and data regulator step in

CSC Telecom, a bulk text message provider, said on Thursday, 12 November, that it had fixed security flaws in its database and closed access to it, LSM, the Latvian public broadcaster, reported. “One port was open, and it has been closed,” said Jānis Strumpmanis, the company’s commercial director. He said he could not yet say why it happened. The company blamed an error in the database access settings and said it had found no sign that data had been altered, deleted or misused, but it could not fully rule out that someone had viewed or copied it.

What was exposed

The open database was first reported on 11 November by the cybersecurity outlet Cybernews. Its researchers said it was updated in real time and held more than 125 million text messages sent between October 2022 and September 2026, including sender names, recipients’ phone numbers and the full text: authentication codes, temporary passwords, bank transaction alerts and booking details. Senders named include Swedbank, SEB, airBaltic, the insurers ERGO, Compensa and Artea, and several retailers. Lithuania and Estonia were also affected. The company has not confirmed the figure.

Police, regulator and CERT.LV

The State Police have opened an internal inquiry on their own initiative and are working with CERT.LV, Latvia’s cyber incident response team. The Data State Inspectorate (DVI), the data protection regulator, has not received a personal data breach notification from CSC Telecom; the company is still assessing whether it must file one. Lāsma Dilba, the regulator’s acting director, said the published material showed the situation was clearly not in order and that its scale and who was responsible had to be established. Gints Mālkalnietis, an expert at CERT.LV, said it could not be stated with certainty that criminals had not accessed the database.

What the companies say

Swedbank has suspended its use of CSC Telecom and is still investigating, but sees no immediate risk to customers’ money or online banking. SEB said only its pension fund had used the provider, for general messages about voluntary private pensions, and that CSC Telecom had not informed it of the incident. airBaltic is still assessing the situation; one of the services that may have been affected is text invitations to check in for flights, which the airline stopped sending about 18 months ago. ERGO has started its own check.

Banks and experts advise people not to trust unexpected texts, calls or emails asking for personal data, passwords or authentication codes, and where possible to switch from text messages to in-app notifications. They also suggest changing passwords for accounts protected by text message codes.