CSC Telecom SMS leak: how 125M texts were exposed
An open ClickHouse database at CSC Telecom exposed years of bank alerts, login codes and medical texts. Here's how it happened and how to prevent it.
On this page 3 sections ▾
TL;DR
- Swedbank has stopped using CSC Telecom, and Latvia's CERT.LV has asked the company for an in-depth investigation and passed the case to law enforcement.
- No one has shown that criminals read the messages, but people who got texts from the affected senders are being told to watch for convincing phishing.
The CSC Telecom SMS leak wasn't a clever hack. A database left open without a password let anyone on the internet read more than 125 million text messages sent to people in Latvia, Lithuania and Estonia, from bank alerts and login codes to medical results, and new messages kept landing in it as they were sent.
Quick facts
The database updated in real time, so a login code or password reset link could have been read before the person it was meant for saw it.
In September 2026, the service had sent more than 3 million texts by the day the database was found.
Messages from Latvia's 112 emergency line were in the database too, alongside texts from Swedbank, SEB, airBaltic, ERGO and Porsche.
#How the CSC Telecom SMS leak happened
On September 28, 2026, Cybernews researchers found a ClickHouse database run by CSC Telecom's Latvian branch sitting open on the internet. CSC Telecom sends text messages on behalf of businesses (bank alerts, delivery updates, login codes), and this database logged those messages. Three mistakes stacked on top of each other:
ELI5: explain it simply▾
THE WORDS
- ClickHouse
- A database built to store and search huge numbers of records very quickly.
- Open on the internet
- Reachable by anyone online, not just by the company's own servers.
THE IDEA
Picture a post office that keeps a photocopy of every letter it delivers, in a filing room with the door propped open onto the street. Nobody had to pick a lock. They only had to notice the open door.
- No passwordThe database could be reached from the internet and didn't ask who you were, so anyone who found its address could read it.
- Full message text storedIt kept the complete contents of each text, including codes, balances and addresses, plus phone numbers, timestamps and routing details.
- Four years keptThe records ran from October 2022 to September 2026, far longer than anyone needs a text once it has been delivered.
Open ClickHouse servers are a known problem. After the DeepSeek leak in early 2025, which also came from an open ClickHouse database, ClickHouse said the default user in its Docker images could be created without a password and turned off network access for that user in its official images. The same post counted more than 30,000 ClickHouse instances reachable from the internet. In a standard install, an admin has to change the network settings before outsiders can connect at all.
#Who was affected and what's happened since
The exposed texts came from banks, insurers, retailers, medical providers and an airline. Messages tied to Swedbank showed account IBANs, transaction amounts, remaining balances and where purchases were made. CSC Telecom has said it fixed an access-configuration flaw and saw no signs of an attack, according to Mallory's roundup of the company responses.
The leak could also bring regulators in. Identity Week reports it is drawing scrutiny under the EU's GDPR, whose data minimisation principle means companies should keep only the personal data they actually need, which makes four years of readable texts hard to defend.
- Oldest messages in the database
- Cybernews finds the open database
- Cybernews reports the exposure privately
- Public access to the database is closed
- Cybernews publishes. Swedbank stops using CSC Telecom, airBaltic warns customers about suspicious texts, and CERT.LV asks for an investigation
#How to prevent a leak like this
None of the fixes need special tools. If you run a database, these are the things to confirm:
Lock down any database you run
- It listens only on localhost or a private network, never on a public IP
- Every account has a password, including the built-in default user
- Only the servers that need it can connect, through a firewall rule or IP allowlist
- Sensitive fields are encrypted at rest
- Data you no longer need is deleted on a schedule, not kept for years
- You scan your own public IPs for open database ports before someone else does
To check that last item for ClickHouse, try its two default ports, 8123 (HTTP) and 9000 (its native protocol), from a machine outside your network. Connection refused or a timeout is what you want to see. A line ending in succeeded means the port is open to the internet.
# swap 127.0.0.1 for your server's public IP student@opnf:~$ nc -zv -w 3 127.0.0.1 8123 nc: connect to 127.0.0.1 port 8123 (tcp) failed: Connection refused student@opnf:~$ nc -zv -w 3 127.0.0.1 9000 nc: connect to 127.0.0.1 port 9000 (tcp) failed: Connection refused
In ClickHouse, the first two items come down to a few lines of config. This file gives the default user a password and only lets it log in from the server itself:
| 1 | <clickhouse> |
| 2 | <users> |
| 3 | <default> |
| 4 | <password_sha256_hex>SHA-256 hash of your password</password_sha256_hex> |
| 5 | <networks> |
| 6 | <ip>127.0.0.1</ip> |
| 7 | <ip>::1</ip> |
| 8 | </networks> |
| 9 | </default> |
| 10 | </users> |
| 11 | </clickhouse> |
Apps that connect from other servers should then get their own users, with only the access they need.
Want to practice security hands-on? Security Pro runs in a simulated terminal in your browser, and Level 1 is free.
Was my data in the CSC Telecom leak?
Is SMS two-factor authentication safe?
What this means for you
For IT teams: check today that no database you run answers from the internet without a password, and ask your SMS and email vendors how long they keep message contents. If you got texts from these senders, be wary of messages that quote real account details, and call your bank on its official number before acting on one.