ShinyHunters Claims Large-Scale Data Theft From Dutch Telecom Odido

ShinyHunters has claimed responsibility for breaching Dutch telecommunications provider Odido (and brand BEN) and stealing a much larger dataset than the company initially indicated. Odido previously disclosed that attackers accessed its customer contact system and downloaded customer data, reporting the incident to the Dutch Data Protection Authority, cutting off attacker access, and bringing in external incident-response support. Odido said the exposed data varied by customer and could include identifiers and contact details such as name, address, mobile number, customer number, email address, IBAN, date of birth, and some ID details (e.g., passport/driver’s license numbers and validity), while stating that Mijn Odido passwords, call/location/data/billing details, and scans of identity documents were not exposed.

ShinyHunters subsequently listed Odido on its leak site and alleged theft of ~21 million records tied to ~8 million customers, asserting Odido downplayed the scope. The gang’s claims also include highly sensitive elements—most notably plaintext passwords—and additional materials such as internal corporate documents and source code, which (if accurate) would materially increase risks of credential stuffing/account takeover, identity fraud, and follow-on intrusion. At the time of reporting, the expanded dataset details (including plaintext passwords and source code) were presented as attacker claims rather than independently confirmed by Odido.