Odido

What Happened

Dutch telecom provider Odido, the largest mobile operator in the Netherlands, disclosed in mid-February 2026 that attackers had gained unauthorised access to a customer contact system. According to Odido's own statement and reporting by TechCrunch, the breach is believed to have occurred on or around February 7 and 8, 2026.

The compromised data reportedly includes customer names, home and email addresses, phone numbers, dates of birth, bank account numbers (IBANs), and metadata from government-issued identity documents such as passport and driver's licence numbers. Odido has stated that passwords, call records, billing data, location information, and scanned copies of identity documents were not part of the breach.

The threat actor group known as ShinyHunters has been linked to the incident. According to NL Times, the group initially demanded approximately EUR 1 million in ransom, later lowering this to EUR 500,000. Odido publicly refused to pay, citing advice from law enforcement and cybersecurity advisors. Following this refusal, the full dataset was reportedly published on dark web forums over several days beginning March 1, 2026.

Subsequent reporting by NL Times and RTL revealed that the leaked data included records associated with Dutch government ministers, a senior intelligence official, individuals under state protection, and over 16,000 employees working in critical sectors including companies such as ASML and Philips.

An analysis by IO+ noted that the attack method was not a zero-day exploit but rather social engineering, specifically phishing and impersonation of IT staff, which was used to bypass multi-factor authentication. The publication raised questions about why a single compromised account could access records belonging to millions of customers, pointing to a failure in access segmentation and the principle of least privilege.

Threat Actor Profile

ShinyHunters is a prolific threat group responsible for multiple high-profile breaches in early 2026, operating a coordinated campaign targeting SSO credentials via voice phishing.

The group's Odido attack used social engineering and impersonation of IT staff rather than technical exploits, demonstrating their focus on human-layer vulnerabilities.

Regulatory Context

GDPR applies directly, with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) overseeing the response. Fines of up to 4% of annual global turnover are possible.

The exposure of government officials' data may trigger additional national security review processes.

Learnings and Recommendations

This incident is a reminder that social engineering remains one of the most effective attack vectors, even against large organisations with multi-factor authentication in place. MFA on its own is not a silver bullet if it can be bypassed through well-crafted phishing or impersonation.

Organisations holding large volumes of personal data should pay close attention to internal access controls. The fact that a reportedly single point of compromise could lead to the alleged exfiltration of millions of records suggests insufficient segmentation. The principle of least privilege, where each user or role has access only to the data it absolutely needs, is not a nice-to-have. It is a fundamental control.

For companies and individuals in the supply chain of telcos, this also highlights the downstream risk. If your staff or customers are among the subscribers of a breached provider, their personal details may now be in the hands of threat actors, whether or not your own systems were involved.