Loading story…
Dutch telecom provider Odido and its budget subsidiary Ben reported that a February 2026 breach exposed data on approximately 6.39 million active and former customers. ShinyHunters allegedly obtained an employee's username, password, and MFA token through a Dutch-language social-engineering call to the helpdesk, then used legitimate Salesforce APIs to export about 90 GB of customer-contact data—roughly 15 million rows—from the company’s CRM environment.
The group reportedly published the stolen data after Odido refused a ransom demand of about €1 million. Dutch police are investigating possible Dutch involvement and released a recording of the alleged caller’s voice to the public, seeking information that could identify the suspect.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
Dutch police released the full recording of the alleged social-engineering caller on Opsporing Verzocht, seeking public assistance identifying the voice. A police-consulted voice expert assessed the recording as a genuine human voice rather than AI-generated speech.
Dutch investigators said they had strong indications that Dutch nationals were involved in the Odido intrusion.
ShinyHunters reportedly completed publication of the stolen Odido data cache. Have I Been Pwned later confirmed roughly six million unique email addresses appeared across four releases.
After Odido declined the reported ransom demand, ShinyHunters allegedly began releasing the stolen customer data. Odido said approximately 6.39 million active and former Odido and Ben customers were affected.
Odido confirmed unauthorized access to its customer-contact system on February 7 and 8. The attackers allegedly used harvested credentials to access Salesforce and exfiltrate about 90 GB of data across roughly 15 million rows through legitimate APIs.
A Dutch-speaking caller impersonating an IT colleague contacted Odido's customer-service helpdesk on February 5 and 6, allegedly causing an employee to submit a username, password, and MFA token to an attacker-controlled credential-harvesting system.
ShinyHunters reportedly demanded approximately €1 million to avoid disclosure of the stolen Odido and Ben customer data, and Odido refused the demand.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceinfosec.pub
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**ShinyHunters** has claimed responsibility for breaching Dutch telecommunications provider **Odido** (and brand **BEN**) and stealing a much larger dataset than the company initially indicated. Odido previously disclosed that attackers accessed its customer contact system and downloaded customer data, reporting the incident to the Dutch Data Protection Authority, cutting off attacker access, and bringing in external incident-response support. Odido said the exposed data varied by customer and could include identifiers and contact details such as name, address, mobile number, customer number, email address, **IBAN**, date of birth, and some ID details (e.g., passport/driver’s license numbers and validity), while stating that Mijn Odido passwords, call/location/data/billing details, and scans of identity documents were not exposed. ShinyHunters subsequently listed Odido on its leak site and alleged theft of **~21 million records** tied to **~8 million customers**, asserting Odido downplayed the scope. The gang’s claims also include highly sensitive elements—most notably **plaintext passwords**—and additional materials such as internal corporate documents and source code, which (if accurate) would materially increase risks of credential stuffing/account takeover, identity fraud, and follow-on intrusion. At the time of reporting, the expanded dataset details (including plaintext passwords and source code) were presented as **attacker claims** rather than independently confirmed by Odido.
Jun 29, 2026
Dutch telecom **Odido** reported that attackers stole data on **6.2 million** current and former customers, while the threat actor claimed the dataset covers **8+ million** people and demanded **€1M+** in ransom, threatening to publish data in daily tranches if unpaid. Reporting indicates the company refused to pay, and the extortionists proceeded with a staged leak strategy intended to maximize public and media impact. Subsequent leak batches reportedly included not only typical customer identifiers (e.g., names, addresses, phone numbers, dates of birth, bank account numbers, and ID numbers) but also **internal customer-service notes** containing highly sensitive context such as stalking, threats, domestic violence, and protected addresses—creating potential **physical safety risks** for affected individuals. The leak cadence was described as multiple dumps over consecutive days (including a “final dump”), drawing significant national attention in the Netherlands and increasing the likelihood of intensified law-enforcement focus on the perpetrators.
Jun 29, 2026
Dutch telecommunications provider **Odido** disclosed a cyberattack in which threat actors gained unauthorized access to a **customer contact/CRM system** and **downloaded personal data** associated with approximately **6.2 million customer accounts**. Odido stated the intrusion was detected over the **February 7–8** weekend and that access was terminated as quickly as possible; the company also reported the incident to the Dutch Data Protection Authority (**Autoriteit Persoonsgegevens**) and engaged external cybersecurity experts to support investigation and additional defensive measures. Odido said its **telecom operations were not disrupted**, and no threat actor group has publicly claimed responsibility; reporting also notes the attackers allegedly contacted Odido to assert they had stolen millions of records. Exposed data varies by customer but may include **full name, address/place of residence, mobile number, customer number, email address, IBAN bank account number, date of birth, and identification document details** (e.g., passport/driver’s license number and validity). Odido emphasized that **passwords** (including for the *My Odido* portal), **call logs**, **location data**, **invoice/billing details**, and **scans of ID documents** were **not** affected. Odido is notifying impacted individuals via email from **`info@mail.odido.nl`** or by SMS, and warned that the stolen data could be used for **impersonation and phishing** attempts that appear to come from Odido.
Jun 29, 2026