Strazdiņš on "CSCTelecom" database leak: text messages may be a "gold mine" for scammers
Cybersecurity blogger Elviss Strazdiņš explains that 125 million text messages, including bank notifications, may have leaked from the Latvian branch of telecom provider "CSCTelecom". The company says the flaws were fixed and access closed.
A database belonging to the Latvian branch of telecom services provider "CSCTelecom" may have exposed about 125 million text messages, according to the tech outlet "Cybernews". Programmer and cybersecurity blogger Elviss Strazdiņš says such data could be extremely valuable to fraudsters, because the messages contain details about people's finances and private lives.
What researchers found
Per "Cybernews", the database held messages from the banks "Swedbank" and SEB, the emergency number 112 service and dozens of retailers. Researchers discovered it on 28 September. It covered messages from October 2022 to September 2026 and was updated in real time. The researchers warn that one-time codes and password reset links could allow attackers to take over accounts.
The company's response
"CSCTelecom" says that after being notified of the security flaws it fixed them and closed the access in question. It checked its servers and available technical information and so far has found no sign that data was altered or deleted, nor evidence of malicious use. However, these findings do not fully rule out that data was viewed or copied outside the researchers' access. The incident was reported to "Cert.lv", Latvia's cyber incident response institution.
Strazdiņš's assessment
Strazdiņš gives several examples: the database contains "Citybee" confirmation codes, but these most likely can no longer be used. "Ergo" messages include details of insurance cases, while SEB messages cover overdue payments and third-tier pension contributions. In his words, the worst case is "Swedbank", where messages show extensive information about payments and account balances. Combined with a phone number, this is a "gold mine" for scammers. He notes it is unknown who obtained the data.
For the future, Strazdiņš advises switching off text-message notifications and using companies' official apps.
