Cybernews has discovered an exposed database containing over 125 million SMS records from Latvian telecom provider CSCTelecom.
Spanning four years, the publicly accessible database leaked real-time two-factor authentication codes, bank alerts, medical results, and personal addresses. Affected brands include major Baltic institutions like Swedbank, SEB, ERGO, Porsche, and Latvia’s 112 emergency hotline.
Beyond the risk of real-time account hijacking, the 4-year retention window raises critical GDPR compliance questions regarding why text message contents were stored for so long.
Because the database was updated in real time, attackers could have potentially intercepted authentication tokens to hijack user accounts as messages were sent. Furthermore, four years of retained logs allow malicious actors to assemble granular personal profiles on affected individuals.
The incident also triggers major regulatory scrutiny under the EU’s General Data Protection Regulation, which mandates strict data minimisation principles. Security experts are questioning why a telecom vendor retained readable message contents and metadata for nearly four years.
Sign up to receive our Identity Week newsletter for all the latest updates on data breaches and defences.
