Threat watch / Vulnerability
CSCTelecom: four years of bank and airline text messages left in an open database
Cybernews researchers found a publicly accessible ClickHouse database belonging to the Latvian branch of CSCTelecom, a company that sends text messages on behalf of businesses. It held over 125 million SMS messages from October 2022 to September 2026, updated in real time, with message content, recipient phone numbers and sender names such as Swedbank, SEB, airBaltic and Latvia's 112 emergency line. According to Artea, CSCTelecom described "an identified access configuration vulnerability", said it was resolved and that its checks found no signs of an attack. Cybernews says it has no evidence that malicious actors accessed the database.
- Sector
- Tech & SaaS
- Way in
- Exposed or misconfigured
- Product or vendor
- CSCTelecom, ClickHouse
- SMS messages readable in the open database (October 2022 to September 2026)[1]
- 125M+
- How it happened
- A ClickHouse database of CSCTelecom's Latvian branch was publicly accessible and updated in real time, according to Cybernews, which found it on September 28, 2026. Artea quotes CSCTelecom's statement of November 11 describing "a security incident related to an identified access configuration vulnerability".[1] Checked 14 Nov 2026
- What was stolen
- No theft has been reported. The open database held SMS content, recipient phone numbers, customers' business names and metadata (timestamps, prices, network routing). Cybernews warns that because it was updated in real time, anyone watching could have seen authentication codes and password reset links as they were sent. CSCTelecom's checks, as relayed by Artea, found no signs of an attack or of data misuse.[1] Checked 14 Nov 2026
- Who was impacted
- Recipients of text messages sent through CSCTelecom in Latvia, Lithuania and Estonia. Cybernews names senders including Swedbank, SEB, ERGO, Compensa, Artea, airBaltic, CityBee, Barbora, Porsche and Latvia's 112 emergency hotline. SEB says it uses the service only for some pension fund marketing and was not informed of the incident; Artea has suspended its use of CSCTelecom. No number of people is given.[1] Checked 14 Nov 2026
- Threat actor
- Not attributed
Timeline
- Cybernews researchers find the open CSCTelecom database, holding messages back to October 20, 2022. [1]
- Cybernews observes that the database is no longer open. [1]
- CSCTelecom issues a statement, quoted by Artea, on an incident caused by an access configuration vulnerability, which it says is resolved, with no signs of an attack found so far. Cybernews says CSCTelecom had not answered its own request for comment. [1]