Latvian banks and cybersecurity authorities are investigating reports that a telecommunications provider left a database containing more than 125 million text messages publicly accessible, potentially exposing information belonging to customers across the Baltic states.

The findings, reported by Latvian public broadcaster LSM on 11 November, concern CSC Telecom, a company used by businesses to deliver SMS messages. According to research cited by LSM, the database contained messages sent between October 2022 and September 2026 and was being updated in real time.

The reported contents included telephone numbers, message text and technical information. Researchers said some messages contained authentication codes, booking details or other personal information. However, the available reporting does not establish that criminals obtained the database or exploited its contents. Latvia’s cybersecurity response institution, CERT.lv, has requested an investigation to determine the circumstances and whether evidence confirms a leak from the company’s infrastructure. Information has also been passed to law-enforcement authorities. sensitīvi dati nav ietekmēti / Raksts

SEB issued a detailed statement distinguishing its own use of the provider from the broader allegations. The bank said CSC Telecom handled only general pension-fund communications for its Latvian businesses. It received recipients’ telephone numbers and message text, but no account balances, personal identification numbers or other customer records.

SEB also said it had not sent online-banking credentials, authentication codes, passwords or payment information through the company. According to the bank, the incident does not compromise its banking systems or customers’ funds.

Nevertheless, SEB warned that personal information obtained from service providers could make fraudulent messages more convincing. A caller’s knowledge of genuine details about a customer is insufficient evidence that the caller represents a trusted organisation. SEB

Swedbank has suspended its use of the provider while examining the incident, according to LSM. That response illustrates why the investigation extends beyond the security of individual banks: organisations can face exposure through companies that deliver routine communications on their behalf.

The immediate challenge is to establish which messages were accessible, which customers were affected and whether anyone outside the authorised service chain retrieved the information. Those questions remain separate from whether a bank’s own systems were breached.

For customers, the uncertainty makes accurate communication particularly important. Broad claims that banking passwords have been stolen risk overstating the evidence, while assurances about banking systems do not resolve the separate question of exposed telephone numbers or messages. The investigation must establish both the technical scope of the incident and its practical consequences.