Odido Data Breach 2026: Telecom Giant Kept Customer Data 5-10 Years Too Long

Odido Data Breach 2026: Telecom Giant Kept Customer Data 5-10 Years Too Long

Dutch telecommunications provider Odido has been caught retaining customer data for 5-10 years beyond its stated two-year retention policy, exposing millions of former customers to a massive data breach that compromised 6.2 million accounts in February 2026. The Dutch Data Protection Authority is now investigating what privacy lawyer Daniëlle Molenkamp calls a 'kwalijke zaak' (serious matter) that violates GDPR principles and puts former customers at significant risk.

What Happened in the Odido Data Breach?

On February 7-8, 2026, unidentified hackers gained access to Odido's customer contact system and covertly downloaded extensive customer information. The breach affected approximately 6.2 million customer accounts, representing about one-third of the Netherlands' population. The stolen data includes:

• Customer names and contact information
• Postal and email addresses
• Phone numbers and customer account numbers
• Bank account numbers (IBAN)
• Dates of birth
• Government-issued ID details (passport/driver's license numbers)

While Odido claims no passwords, billing information, or call records were compromised, the exposure of sensitive identification data has triggered mass customer defections. According to Internetten.nl, nearly a quarter of all provider switches in the four days following the breach involved Odido customers leaving - triple the normal rate.

The Data Retention Violation

What is GDPR Data Retention?

Under the General Data Protection Regulation, organizations must retain personal data only for as long as necessary for the original processing purpose. While GDPR doesn't specify concrete retention periods, organizations must establish and document reasonable time limits based on their specific situation. Odido's privacy policy explicitly stated that ex-customer data would not be kept longer than two years after contract termination.

However, the recent breach notifications revealed a shocking reality: customers who ended their contracts 5-10 years ago received breach notifications, indicating Odido had retained their data far beyond its stated policy. Privacy lawyer Daniëlle Molenkamp, a certified privacy professional (CIPP/E), told BNR: 'Wettelijk gezien is er niet één bepaalde bewaartermijn die voor gegevens geldt. Er moet altijd worden gekeken naar hoe lang het bewaren van gegevens nodig is. Voor Odido was dat een termijn van twee jaar, maar blijkbaar hanteren ze die niet en dat is kwalijk.'

Legal Implications and Potential Sanctions

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has confirmed it will investigate the case. Potential consequences for Odido include:

This isn't Odido's first regulatory issue. In a previous case under its T-Mobile branding, the company was fined €175,000 for improperly processing traffic and location data in collaboration with national statistics agency CBS.

Impact on Customers and Market Response

The breach has created significant consumer backlash. Customers are demanding compensation for costs associated with replacing compromised identification documents. According to AD reports, affected individuals are requesting Odido cover expenses for new passports and driver's licenses, which can cost €60-€100 each in the Netherlands.

Market analysts note this breach comes at a sensitive time for Odido, which operates under private equity ownership by Apax Partners and Warburg Pincus consortium. The incident raises questions about cybersecurity investment levels and compliance with the EU's NIS2 cybersecurity requirements for telecom providers.

The telecommunications sector data breaches have become increasingly common, with Odido's incident following similar breaches at other European telecom companies. However, the data retention violation adds an additional layer of regulatory risk that could result in more severe penalties.

What Should Affected Customers Do?

If you've received a breach notification from Odido, consider these steps:

1. Monitor your accounts: Check bank statements and credit reports for suspicious activity
2. Consider document replacement: Evaluate whether to replace compromised identification documents
3. Document expenses: Keep records of any costs related to the breach
4. Review compensation options: Consult with legal professionals about potential claims
5. Consider switching providers: Research alternative telecom providers if you've lost trust in Odido

FAQ: Odido Data Breach 2026

How many customers were affected by the Odido data breach?

Approximately 6.2 million customer accounts were compromised, representing about one-third of the Netherlands' population.

What data was stolen in the Odido breach?

Hackers accessed names, addresses, phone numbers, email addresses, dates of birth, bank account numbers (IBAN), and government ID details including passport and driver's license numbers.

How long did Odido keep customer data beyond its policy?

Odido retained data for 5-10 years beyond its stated two-year retention period, with some former customers who ended contracts a decade ago receiving breach notifications.

What are the potential fines for Odido's GDPR violations?

The Dutch Data Protection Authority could impose fines up to €20 million or 4% of Odido's global annual revenue for GDPR violations related to improper data retention.

Can affected customers claim compensation?

Yes, customers may pursue compensation claims for damages resulting from the breach, particularly costs associated with replacing compromised identification documents.

Sources

NL Times: Odido Keeps Customer Data Much Longer Than Claimed

TechCrunch: Dutch Phone Giant Odido Says Millions Affected by Data Breach

Dutch Data Protection Authority: Retention of Personal Data

CKH Advocaten: Daniëlle Molenkamp Profile