125 Million Texts. Your Bank Code Was in There.

For nearly four years, a database holding more than 125 million text messages sat open on the internet. Anyone who found it could read bank alerts, login codes, password resets, medical results, and travel bookings — for customers of two of the Baltics’ biggest banks, the main airline, and the national emergency hotline.

The database belonged to CSCTelecom, a Latvian telecom that sends texts for other companies. Cybernews’s research team found it on September 28, 2026, told the company the next day — and watched it stay open for another month, until October 27. In September 2026 alone, it sent over 3 million messages. The records go back to October 20, 2022.

No evidence says criminals found the database first. But if a research team could find it, so could anyone else — and anyone who found it before September 28 had four years of private messages to read.

What was inside

The database held phone numbers, every message’s contents, and metadata — updated in real time, so every new message landed in the open database as it went out. The contents covered bank alerts, login codes, passwords, medical results, and travel bookings.

The affected organizations read like a directory of everyday life in Latvia, Lithuania, and Estonia: Swedbank and SEB; airBaltic; the 112 hotline; the insurer ERGO; retailers including Porsche, CityBee, Barbora, EuroCash, DEPO, Akropolis, and IKI. Dozens of companies, most of them household names there.

The live code problem

A leaked marketing message is embarrassing. A leaked login code is a break-in waiting to happen — and this database leaked login codes live.

Businesses send one-time codes and password resets by text. Those codes are only safe because they expire in minutes and only the intended recipient should see them. This database broke both protections: the codes sat in a public database, updated in real time, so anyone watching the feed could read a code the moment it was sent — sometimes before the real user even saw it. With a fresh code, an attacker could pass a two-factor check or reset a password and walk in.

Four years of messages is enough to profile nearly anyone in it: where they shop, which banks they use, when they travel, what tests they have had, how much they spend. Numbers tied to luxury brands or high balances could pick the most lucrative targets. And knowing which services a number uses makes phishing far more convincing — a fake message from your bank, grocer, and airline at once is harder to spot than a random scam text.

Who was exposed

The Swedbank messages are the most sensitive: IBAN numbers, transaction amounts, recipients, remaining balances — sometimes even the stores where purchases were made — tied to phone numbers. SEB messages exposed phone numbers; airBaltic’s carried phone numbers, flight details, and last names; the 112 hotline’s included phone numbers and case details; ERGO’s carried document numbers, vehicle registrations, and invoice amounts.

None of this was the customers’ fault. Nobody who got a bank alert or a flight confirmation chose the sender, or knew a third-party provider was storing the message for years. That is the supply-chain lesson: your data lives with every provider your bank, airline, and insurer uses — and you never get to audit any of them. Finnair’s customers learned the same lesson this week, when a breach at travel provider Amadeus exposed 116,000 bookings — and a cloud lapse exposed 7.7 million shoppers at Iris Ohyama.

Why keep four years of texts?

The leak also raises a question regulators will want answered: why did an SMS provider keep message contents and phone numbers for nearly four years? European law requires companies to keep personal data no longer than necessary. A text has done its job the moment it is delivered. Four years of storage is not delivery — it is an archive nobody secured.

Text messages were never private

This leak is a reminder of what security people have said for years: SMS was never a secure channel. Texts have no end-to-end encryption and no confidentiality guarantees. They can be intercepted through SIM swapping, where an attacker convinces a carrier to move your number to their SIM, or through SS7 attacks at the network level. Numbers can even be reassigned to a new user after inactivity, so someone else eventually receives messages meant for you.

Researchers recommend opting out of SMS authentication wherever possible — though many affected services offer no alternative, leaving users stuck with the platform’s choice.

What to do if you were affected

Change your passwords — starting with banking, email, and any account that used SMS-based two-factor codes.

Switch to app-based two-factor authentication. Authenticator apps, or the options built into password managers, never travel through an SMS database.

Watch for phishing that knows too much. A message referencing a service you use, a trip you booked, or an appointment you had is suspicious — that detail could come from the leak.

Monitor your accounts. Check financial accounts for unauthorized access, especially services that sent password resets or login codes by text.

CSCTelecom has not commented. The database is closed now — but four years of messages were open before it was, and the codes and balances in them do not expire now that the door finally shut.