Odido Data Breach Exposes Almost 690,000 Telecom Customer Accounts
Published
Key Takeaways
- Massive Data Exposure: A significant data breach at the Dutch telecom provider Odido in February 2026 exposed millions of customer records.
- Attribution and Extortion: The ShinyHunters hacking group has claimed responsibility, demanding a ransom and threatening to leak data daily until paid.
- Sensitive Data Compromised: The leaked information includes names, addresses, phone numbers, bank account details, and potentially passport numbers.
Dutch telecommunications firm Odido has confirmed that it was the target of a major data breach and subsequent extortion attempt in February 2026, resulting in a substantial customer data leak that compromised millions of records. On February 26, breach notification service Have I Been Pwned (HIBP) added 688,102 breached accounts to its database.
ShinyHunters claimed responsibility for the Dutch telecom hack and began publishing customer data on the dark web after Odido refused to negotiate or pay a ransom.
ShinyHunters Cyberattack and Data Publication
Odido said cybercriminals gained unauthorized access to a customer contact system on February 7, estimating the initial leak was approximately six million records. The ShinyHunters cyberattack escalated when the group began releasing the stolen data in stages, threatening to publish one million lines worth of customer data per day, National broadcaster NOS reported today.
HIBP said the first batch contained 317,000 unique email addresses, and the attackers followed through on their threats to release more data, publishing another million records (of an alleged 21-million set) with 371,000 additional unique email addresses the next day.
The compromised data is highly sensitive, as the HIBP dataset contains:
- Bank account numbers
- Customer service comments
- Dates of birth
- Driver's licenses
- Email addresses
- Names
- Passport numbers
- Phone numbers
- Physical addresses.Â
Odido Data Breach Cybersecurity Implications
Following the Odido data breach disclosure, the company “came to the decision not to engage in negotiations with these criminals or submit to their attempts at blackmail," the company said in a statement cited by Reuters. The public refusal to pay the ransom aligns with official law enforcement advice.Â
Reuters reported that this attack is one of the largest data breaches in the Netherlands' history, affecting a significant portion of the company's customer base, which formerly operated as T-Mobile's Dutch arm.
This month, cyberattacks on Singapore telecom companies Singtel, StarHub, M1, and Simba Telecom were linked to the UNC3886 cyberespionage group, and China-nexus espionage APT UAT-7290 targeted telecom infrastructure in South Asia.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular