Latvian SMS provider exposed 125 million texts with login codes and bank alerts

The Latvian branch of CSCTelecom, a company that sends text messages on behalf of businesses, left a database of more than 125 million SMS messages open to anyone on the internet. Cybernews reported on 11 November that the messages date from October 2022 to September 2026 and include one-time login codes, password reset links, bank alerts and flight details sent to people in Latvia, Lithuania and Estonia. The database was updated in real time, so anyone watching it could see a code at the same moment it reached the recipient's phone.

The database ran on ClickHouse and held the full text of each message, the name of the business that sent it, timestamps, the price of each message and mobile network routing data. Cybernews lists authentication codes, temporary passwords, medical test results, reservation details, delivery updates with names and addresses, travel dates and bank transaction notices.

Swedbank messages showed IBAN account numbers, transaction amounts, recipients, remaining balances and, in some cases, the shop where a purchase was made. Messages from the insurer ERGO contained document numbers, vehicle registration numbers and invoice amounts. Records linked to the 112 emergency line showed phone numbers and case details. airBaltic messages contained flight details and passengers' surnames, and the car-sharing service CityBee and the Lithuanian supermarket chain IKI sent login codes through the gateway.

Read the full article on vpnlab.io: https://vpnlab.io/en/csctelecom-latvia-sms-leak-125-million-2fa-codes-3339