Odido Customer Contact System Breach Exposes Data of 6.2 Million Customers

Dutch telecommunications provider Odido disclosed a cyberattack in which threat actors gained unauthorized access to a customer contact/CRM system and downloaded personal data associated with approximately 6.2 million customer accounts. Odido stated the intrusion was detected over the February 7–8 weekend and that access was terminated as quickly as possible; the company also reported the incident to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and engaged external cybersecurity experts to support investigation and additional defensive measures. Odido said its telecom operations were not disrupted, and no threat actor group has publicly claimed responsibility; reporting also notes the attackers allegedly contacted Odido to assert they had stolen millions of records.

Exposed data varies by customer but may include full name, address/place of residence, mobile number, customer number, email address, IBAN bank account number, date of birth, and identification document details (e.g., passport/driver’s license number and validity). Odido emphasized that passwords (including for the My Odido portal), call logs, location data, invoice/billing details, and scans of ID documents were not affected. Odido is notifying impacted individuals via email from info@mail.odido.nl or by SMS, and warned that the stolen data could be used for impersonation and phishing attempts that appear to come from Odido.