← News
/DISPATCH · 2026-09-13

Dutch Telco Odido 6.39M Customer Breach: Police Release Suspect Call Audio, Hackers Threaten Another Attack

Dutch telco Odido leaked 6.39 million customer records—including IBANs and ID numbers—via an IT-impersonation phone scam. Dutch police released the suspect call audio on 7 Sep. ShinyHunters claimed the speaker as a member and threatened another large-scale data theft.

Dutch telecom operator Odido's 6.39 million customer data leak has a new development: on 7 Sep 2026, Dutch police released the suspect's phone-scam call audio on the TV manhunt program *Opsporing Verzocht*. The next day, extortion group ShinyHunters confirmed to Dutch media that the speaker is a member, said a criminal-defense lawyer is already retained, and threatened another large-scale data theft in the Netherlands. The incident covers ~6.39 million customers of Odido and its Ben brand—one of the largest personal-data leaks in Dutch history.

Incident overview

The incident started with a phone call on 5–6 Feb 2026. A Dutch-speaking man used English IT jargon, claimed to be an IT-department colleague, and contacted Odido support about an urgent technical outage. Support staff were steered to log into a fake internal system controlled by the attacker. Username, password, and MFA token were captured together. On 7–8 Feb, the attacker entered Odido's Salesforce-based CRM and exported ~90 GB / ~15 million rows via the platform's legitimate API. Odido later confirmed ~6.39 million people affected.

Technical details

No software vulnerability was used. No malware was deployed. The path is pure social engineering: fabricate urgency, borrow an internal identity to build trust, steer the employee to a cloned login page, then walk stolen credentials plus a valid MFA token through authentication.

Exfiltration was equally quiet: the attacker called Salesforce's official API to bulk-export records. Those requests look like normal business-report exports. Without joint monitoring of identity, export volume, and behavior, they are hard to distinguish from legitimate ops. Post-incident review pointed to three gaps: no callback verification of the caller, over-privileged support accounts, and no effective monitoring of bulk data export.

In the extortion phase, attackers demanded ~€1 million. Odido refused. ShinyHunters began publishing data in batches from 26 Feb, and by 1 Mar claimed the full dataset was out. Have I Been Pwned recorded ~6 million unique email addresses across four dumps. Leaked fields include name, date of birth, customer number, address, phone, email, IBAN, and for some people passport or driver's-license numbers. Odido says account passwords, call records, and billing data were not leaked; ShinyHunters disputes this. The two statements have not been reconciled.

Impact

Leaked data is directly reusable for identity fraud and targeted scams. Dutch police reported mass phishing-email floods after disclosure. Attackers had enough fields to write highly credible dunning, refund, or account-recovery messages. Even after incident response, identity and bank fields persist in criminal channels for years. Password resets do not fix this.

Remediation

References