Odido confirms massive breach; 6.2 Million customers impacted

Hackers accessed data from 6.2 million Odido accounts, exposing names, contacts, bank details, and ID numbers. Subsidiary Ben also warned customers.

Hackers broke into Dutch telecom firm Odido and accessed data from 6.2 million accounts. The company confirmed the breach and said attackers took names, addresses, phone numbers, email addresses, bank account details, dates of birth, and passport or ID numbers.

“Odido has been hit by a cyberattack, which compromised customer data. This involved personal data from a customer contact system used by Odido. No passwords, call logs, or billing information were affected.” reads a notice published by the company on its website. “The unauthorized access to the system was terminated as quickly as possible. Odido also engaged external cybersecurity experts to assist with implementing additional security measures as part of the incident response.”

The telco said the breach did not expose My Odido account passwords, call records, location data, invoice details, or scans of ID documents.

Odido’s subsidiary Ben also warned its customers that hackers may have stolen their information.

Odido is a Dutch telecommunications company and one of the largest mobile network operators in the Netherlands. It was formed when T-Mobile Netherlands and Tele2 were rebranded as Odido in 2023 after private equity firms Apax Partners and Warburg Pincus acquired the business.

Odido serves around 8 million mobile subscribers and about 1 million fixed broadband customers nationwide. The company provides mobile telephony, wireless broadband, and related services under multiple brands including Odido, Ben, and Simpel.

Financially, Odido generates around €2 billion in annual revenue, with growth in consumer broadband and business mobile services contributing to its topline

The telco discovered the hack last weekend and reported it to the Dutch privacy watchdog. The company said it quickly stopped the unauthorized access and brought in cybersecurity experts to strengthen its defenses.

“The unauthorised access to the system was ended as quickly as possible,” the company said in a statement. “In addition, Odido has brought in cybersecurity experts to implement additional security measures in response to this incident.”

The company urges customers to stay alert for suspicious activity. Criminals may use stolen details to pose as Odido, banks, or other companies through calls, texts, or emails. Avoid clicking unknown links and check senders carefully. Verify unexpected calls by contacting the company directly using official numbers. Never share passwords or PINs. Review invoices closely, as scammers may send fake payment requests. When in doubt, check your account or contact customer support.

The company did not disclose technical details about the attack.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, data breach)