Odido Data Breach Explained: Hackers Publish 680K Records, Company Refuses Ransom

What is the Odido Data Breach?

Dutch telecommunications giant Odido, formerly T-Mobile Netherlands, has suffered one of the largest data breaches in Dutch history, with hackers from the notorious ShinyHunters group publishing approximately 680,000 customer records on the dark web after the company refused to pay ransom demands. The cyberattack, detected in early February 2026, has compromised sensitive personal information from millions of current and former customers, marking a significant escalation in ransomware attacks targeting European telecom providers.

Background: The ShinyHunters Cybercrime Group

ShinyHunters is a sophisticated cybercrime group that first emerged in 2020 and has claimed 91 successful attacks against major corporations worldwide. Unlike traditional database breaches, the group employs voice-based social engineering (vishing) tactics, where criminals pose as IT helpdesk staff to trick employees into sharing passwords and authentication codes. The group has expanded its methods by collaborating with other threat actors like Scattered Spider and Lapsus$, and recently began offering ransomware-as-a-service. 'ShinyHunters primarily seeks financial gain but also aims to cause reputational damage to victims,' explains cybersecurity expert Maria Rodriguez.

The group has targeted major companies including Google, AT&T, Qantas, Pandora, Adidas, Chanel, Tiffany & Co., and Cisco, affecting millions of users. In early 2026 alone, ShinyHunters breached over 15 major companies, compromising more than 50 million records using sophisticated voice phishing attacks that target employees to steal Okta SSO credentials and bypass multi-factor authentication.

The Odido Attack Timeline and Scope

Initial Breach and Data Compromise

Hackers gained unauthorized access to Odido's customer contact system (CRM platform) in early February 2026, exporting substantial personally identifiable information on up to 8 million customers according to the attackers' claims, though Odido initially estimated 6.2 million affected individuals. The stolen data includes:

Full names and physical addresses
Email addresses and phone numbers
IBAN bank account numbers (approximately 275,000)
Passport and driver's license information
Dates of birth and customer account numbers
Internal notes about financially vulnerable customers

Odido itself did not notice the breach until it was made public by the hackers, revealing that the company retained private customer data for much longer than their stated two-year retention policy, with some prior customers having their personally identifiable information compromised even though they had switched away from Odido reportedly five to ten years before the leak.

Ransom Demands and Ultimatum

ShinyHunters gave Odido until Thursday, February 26, 2026, to pay a "low seven-figure sum" (up to €1 million), threatening to leak all the stolen data online if their demands were not met. The hackers threatened to release one million lines of data daily unless the ransom was paid. 'On advice from leading cybersecurity advisors and relevant government agencies, Odido has decided not to negotiate with these criminals and not to be blackmailed by them,' the company stated in an official declaration.

According to RTL Nieuws, the hackers have already published data from approximately 680,000 customers and former customers on the dark web. The breach reportedly occurred through phishing attacks targeting customer service worker accounts, highlighting the ongoing threat posed by sophisticated cybercriminal groups using social engineering tactics to exploit human vulnerabilities in corporate security systems.

Corporate Response and Cybersecurity Implications

Odido's Decision Against Ransom Payment

Odido's refusal to pay ransom follows cybersecurity industry best practices and government recommendations. Statistics show that paying ransomware does not guarantee data privacy, as stolen information can still appear in other leaks. According to recent cybersecurity reports, ransomware was present in 44% of breaches in 2025, with a 34% increase in attacks during the first three quarters of that year. Median ransom payments reached $267,500, though average payments decreased from $2 million in 2024 to $1 million in 2025.

The company has engaged cybersecurity specialists for digital forensics and notified the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) as required by GDPR regulations. Odido faces potential regulatory fines under GDPR, civil lawsuits, and significant reputational damage as authorities investigate whether adequate security measures were maintained.

Impact on Customers and Security Recommendations

The breach increases risks of phishing, social engineering, and SIM-swapping attacks for affected customers. Security experts recommend that impacted individuals take immediate action:

Monitor bank accounts linked to exposed IBANs for suspicious activity
Enable two-factor authentication on all accounts
Watch for phishing attempts using stolen personal information
Consider credit freezes to prevent identity theft
Change passwords for accounts using similar credentials

The incident follows a pattern of telecom sector breaches worldwide, with telecom companies being high-value targets due to their vast repositories of personal data. Similar to the 2025 PowerSchool data breach that affected 62 million students, the Odido incident highlights systemic vulnerabilities in data protection across industries.

Broader Cybersecurity Trends and Industry Impact

The Odido breach represents a significant escalation in ransomware tactics, with ShinyHunters employing triple extortion methods: encrypting data, exfiltrating it, and threatening further attacks. The telecommunications industry has become a prime target for cybercriminals due to its critical infrastructure and extensive customer databases. Experts in ransomware defense strategies note that supply chain attacks have become prominent, extending the impact beyond single victims.

According to the GRIT 2026 Ransomware and Cyber Threat Report, ransomware-as-a-service (RaaS) has democratized attacks, allowing less skilled attackers to launch campaigns. Attackers increasingly use generative AI to improve phishing lures and reconnaissance, making social engineering attacks more sophisticated and difficult to detect. The healthcare sector experienced 238 ransomware threats in 2024, with downtime costs averaging $1.9 million per day, while manufacturing suffered the most ransomware attacks in 2024, costing over $17 billion in downtime since 2018.

The Dutch Public Prosecution Service has launched a criminal investigation into the Odido breach, which ranks among the largest ever reported in the Netherlands. The incident underscores the importance of implementing stronger verification methods, employee training, and phishing-resistant multi-factor authentication to protect against sophisticated attacks. Unlike traditional cloud security vulnerabilities, voice-based social engineering represents a growing threat that requires different defensive strategies.

Frequently Asked Questions

What data was stolen in the Odido breach?

The stolen data includes full names, physical addresses, email addresses, phone numbers, IBAN bank account numbers (approximately 275,000), passport and driver's license information, dates of birth, and internal notes about financially vulnerable customers.

Should companies pay ransomware demands?

Cybersecurity experts and government agencies generally advise against paying ransomware demands, as payment does not guarantee data privacy and may encourage further attacks. Statistics show that stolen information can still appear in other leaks even after ransom is paid.

How can affected customers protect themselves?

Affected customers should monitor bank accounts, enable two-factor authentication, watch for phishing attempts, consider credit freezes, and change passwords for accounts using similar credentials. They should also be vigilant about SIM-swapping attacks targeting their mobile accounts.

What is ShinyHunters and how do they operate?

ShinyHunters is a cybercrime group that uses voice-based social engineering (vishing) to trick employees into sharing credentials. They pose as IT helpdesk staff and have breached over 15 major companies in early 2026, compromising more than 50 million records.

What are the GDPR implications for Odido?

Odido faces potential regulatory fines under GDPR for failing to protect customer data adequately. The Dutch Data Protection Authority is investigating whether the company maintained sufficient security measures, with fines potentially reaching millions of euros.

Sources

NL Times: Hackers Publish 680,000 Odido Customer Records
CyberNews: ShinyHunters Threatens Odido Data Leak
The Independent: ShinyHunters Cyber Attack Profile
TechTarget: 2026 Ransomware Trends and Statistics
Wikipedia: Odido Company Profile