Odido Customer Data Breach and Extortion Leak Campaign

Dutch telecom Odido reported that attackers stole data on 6.2 million current and former customers, while the threat actor claimed the dataset covers 8+ million people and demanded €1M+ in ransom, threatening to publish data in daily tranches if unpaid. Reporting indicates the company refused to pay, and the extortionists proceeded with a staged leak strategy intended to maximize public and media impact.

Subsequent leak batches reportedly included not only typical customer identifiers (e.g., names, addresses, phone numbers, dates of birth, bank account numbers, and ID numbers) but also internal customer-service notes containing highly sensitive context such as stalking, threats, domestic violence, and protected addresses—creating potential physical safety risks for affected individuals. The leak cadence was described as multiple dumps over consecutive days (including a “final dump”), drawing significant national attention in the Netherlands and increasing the likelihood of intensified law-enforcement focus on the perpetrators.