Telecom data breach exposes more than 125 million SMS messages in Europe - Escudo Digital

According to an investigation by Cybernews, the breach involved a database belonging to CSCTelecom, a telecommunications provider operating in the Baltic states. The records spanned nearly four years and could still be accessed as new messages were added. The exposed information included temporary passwords, verification codes, bank transactions and medical test results, some of them particularly sensitive.

Exposed Database Details

On 28 September 2026, researchers discovered a publicly accessible ClickHouse database belonging to CSCTelecom's Latvian subsidiary. The database contained messages dating from 20 October 2022 to September 2026. In September alone, the platform had handled more than three million text messages. Alongside phone numbers, the database contained the full text of messages, the dates they were sent, company identifiers, billing data and technical details about the networks used.

The system added new records in real time, creating a particular risk that some security codes could be viewed before their recipients used them.

Affected Organizations

The breach mainly affects Latvia, Lithuania and Estonia and involves companies that serve a large number of customers. Swedbank and SEB were among the banks identified. Swedbank's messages included IBANs, transaction amounts, transfer recipients and available balances.

Researchers also found messages linked to airBaltic containing surnames, phone numbers and flight details. The breach also affected other sectors including insurance (ERGO and Compensa), healthcare (Denticija and Sypsenos Akademija), retail (Porsche, Barbora, DEPO, IKI and Akropolis) and emergency services (Latvia's 112 emergency number).

Security Risks

One of the biggest risks involves one-time authentication codes, which are commonly used to confirm banking transactions or sign in to accounts. If cybercriminals obtained these codes while they were still valid, they could attempt to bypass some two-step verification measures. Password reset links pose another risk, as their exposure could make it easier to gain unauthorised access to personal and work accounts.

Access to several years of messages could also allow someone to piece together spending habits, travel patterns, business relationships and even details about people's health. This information could be used in targeted phishing campaigns, with fraudulent messages made to look as though they came from companies the victims actually deal with.

Regulatory Concerns

The incident highlights an important cybersecurity issue in Europe: how long organisations retain personal data. The General Data Protection Regulation (GDPR) requires organisations to keep personal data only for as long as necessary for the purposes for which it is processed. The fact that the database held nearly four years of records raises questions about whether the full contents of those messages needed to be stored for so long.

Standard SMS messages also lack end-to-end encryption and are vulnerable to known threats, including SIM swapping and certain attacks on telecommunications signalling infrastructure. Cybernews reports that there is so far no evidence that criminals accessed the records or that the exposure led to any account takeovers.

User Protection Advice

People who have received messages from the affected organisations should review their security settings, especially if they use SMS to verify sign-ins. Experts recommend changing passwords for sensitive accounts, reviewing bank transactions and switching from SMS verification to an authenticator app where possible. Users should also be wary of unexpected messages that refer to actual bookings, purchases or financial details.