A publicly accessible database linked to CSCTelecom’s Latvian branch exposed more than 125 million text messages leaked over four years, according to Cybernews. The archive appeared to contain personal and business data tied to organisations across the Baltics, including phone numbers, order identifiers, and two-factor authentication (2FA) codes. Cybernews investigators said the leaked information allowed attackers to build detailed profiles of individual users even without seeing message content, increasing the risk of highly targeted scams. Among the organisations mentioned were EuroCash1, Akropolis, Depo, Iki, Perlas Go, Autoplius, Shypsenos akademija, Denticija, airBaltic and Porsche. The data reportedly included internal phone numbers, visit statistics, authentication codes, and flight-related details such as route information and family names. The Latvian portion of the leak also involved messages related to Swedbank and SEB, medical institutions, online shops, government bodies, and the national emergency number 112. In Estonia, Cybernews said the leak included local airBaltic and Depo units. Analysts said the exposed records covered the period from October 2022 to September 2026 and that the database was updated continuously. Cybernews reported the company was notified of the security flaw on 29 September. The database was later closed on 27 October and was described as inaccessible at the time of reporting. Cybernews warned that attackers could potentially use the data to intercept authentication steps, including password reset links, before targeted recipients even received the relevant messages.