Contained High impact Data breach Checked 1d ago

Odido breach exposes data of 6 million Dutch customers

Attackers tricked Odido customer service staff by phone and stole personal data on about 6.2 million customers. ShinyHunters claimed the theft. Dutch police said they had strong indications Dutch nationals were involved. Police received useful tips after broadcasting the suspect's voice. ShinyHunters later threatened another large data theft in the Netherlands, but no new attack was confirmed.

Started
Feb 5, 2026
Latest activity
Sep 8, 2026
Attributed to
ShinyHuntersSuspected
Where
Netherlands
Sectors
Telecom, Consumers
Scale
one major Dutch telecom provider, personal data of about 6.2 million customers

Current status

On September 10, reporting said ShinyHunters threatened another large data theft in the Netherlands, but no new attack or victim was confirmed.

Contained: The attack has been stopped or blocked. Recovery and investigation are still running.

Who is behind it

Dutch police describe the caller as a Dutch-speaking man with apparent IT knowledge, but he has not been publicly named or confirmed arrested.

Impact

Exposed data continued to be used in phishing. Odido said it had taken security measures and strengthened staff training. ShinyHunters threatened another large-scale theft in the Netherlands, but no new victim was credibly reported by September 10.

What to do

Odido customers should be alert to phishing calls, texts, or emails that use their real name or account details. Open Odido's official website or app yourself instead of using links in messages, and never share codes or personal information with an unverified caller. Anyone who recognizes the suspect's voice can report it at politie.nl/odido.

Timeline

  1. Sep 10, 2026

    Reporting said the threat of another attack remained unconfirmed and no new victim had been reported.

    Containedxgn.nl
  2. Sep 8, 2026

    ShinyHunters threatened another large-scale data theft in the Netherlands and said it would support the suspect, but no new attack was confirmed.

    Containedhartvannederland.nl
  3. Sep 8, 2026

    Odido said it had taken security measures and strengthened staff training after the breach.

    Containedsecurity.nl
  4. Sep 8, 2026

    Dutch police said they had received 20 tips after broadcasting the suspect's voice, including information that could help the investigation.

    Containedwnl.tv
  5. Sep 7, 2026

    Dutch police aired a recording of the suspected caller's voice on the TV program Opsporing Verzocht, after he did not respond to an earlier call to turn himself in, and asked the public for tips at politie.nl/odido. A voice expert confirmed the recording is a real human voice, not AI-generated, and described the speaker as fluent in Dutch with apparent IT or call-center knowledge.

    Containedsecurity.nl
  6. Aug 31, 2026

    A Dutch tech news outlet reported that email addresses leaked in the Odido breach are now being used on a large scale for phishing, with no new arrests or official closure announced.

    Containediphoned.nl
  7. Jul 31, 2026

    Hackify reported that two unique email addresses exposed in the breach received 61 phishing emails during 150 days of monitoring, though no messages arrived after July 3.

    Containedwassenaarders.nl
  8. Jul 26, 2026

    Reports said a modest number of Odido customers switched to rival VodafoneZiggo in the weeks after the breach became known.

    Containednltimes.nl
  9. Jul 10, 2026

    Dutch police said they found strong indications Dutch nationals were involved, including a recorded vishing call to Odido support.

    Containedbleepingcomputer.com
  10. Jun 26, 2026

    Reporting put the number of exposed customers at about 6.39 million as the Dutch police investigation continued.

    Activethecyberexpress.com
  11. Feb 24, 2026

    The ShinyHunters extortion group claimed responsibility for stealing millions of Odido customer records.

    Activebleepingcomputer.com
  12. Feb 12, 2026

    Odido publicly disclosed the cyberattack and said it affected customer data.

    Emergingnewsroom.odido.nl
  13. Feb 5, 2026

    Attackers used a vishing phone call to trick Odido customer service into granting access to customer systems.

    Emergingthecyberexpress.com

Sources

Related reports