{"id":"odido-customer-data-theft-feb-2026","category":"breach","status":"live","title":"Odido IT impersonation breach exposed about 6.39 million people’s customer data","tldr":"Attackers posing as IT staff stole data on about 6.39 million current and former Odido and Ben customers. The data was later published. Ask Odido what was exposed and verify unexpected calls and messages through its official app or website.","summary":"Attackers impersonating IT staff targeted Odido customer service on 5 and 6 February 2026 and stole customer-contact records. Odido attributes the attack to ShinyHunters. Initially reported as affecting 6.2 million customers, its completed notification analysis puts the total at approximately 6.39 million people, including current and former Odido and Ben customers; Simpel was unaffected. Depending on the person, records included contact details, bank account numbers, dates of birth and identification details. Odido says account passwords and identity-document scans were excluded, although some telephone verification code words leaked and their use was stopped. Odido revoked access and says all identified affected customers were contacted. Police confirm the criminals published data after Odido refused to pay. Regulators opened security and retention investigations. A September ShinyHunters arrest was explicitly separate from the Odido case. The reviewed sources do not establish recovery or deletion of the published data, or a concluded Odido criminal case.","action":"If you are a current or former Odido or Ben customer, contact Odido through its official website to ask which details were exposed. Treat unexpected messages cautiously, and use ‘Check je Gesprek’ in the Odido app to verify callers claiming to represent Odido. Do not follow texts asking you to verify your identity to prevent your subscription being blocked.","product":"Odido and Ben customer services in the Netherlands","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["odido","ben","netherlands","data-breach","impersonation","shinyhunters"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Update over de cyberaanval — current undated FAQ","url":"https://www.odido.nl/veiligheid/cyberaanval","by":"Odido","date":""},{"kind":"advisory","title":"Update about cyberattack — current undated English FAQ","url":"https://www.odido.nl/veiligheid-eng","by":"Odido","date":""},{"kind":"news","title":"Odido data breach exposes personal info of 6.2 million customers","url":"https://www.bleepingcomputer.com/news/security/odido-data-breach-exposes-personal-info-of-62-million-customers/","by":"BleepingComputer","date":"2026-02-12"},{"kind":"advisory","title":"RDI en AP starten onderzoek naar aanleiding van het incident bij Odido","url":"https://www.rdi.nl/actueel/nieuws/2026/03/26/rdi-en-ap-starten-onderzoek-naar-aanleiding-van-het-incident-bij-odido","by":"RDI","date":"2026-03-26"},{"kind":"advisory","title":"Politie deelt stem van verdachte in onderzoek naar hack Odido","url":"https://www.politie.nl/nieuws/2026/september/7/11-politie-deelt-stem-van-verdachte-in-onderzoek-naar-hack-odido.html","by":"Dutch Police","date":"2026-09-07"},{"kind":"advisory","title":"Verdachte aangehouden in onderzoek naar hackersgroep ShinyHunters","url":"https://www.politie.nl/nieuws/2026/september/29/11-verdachte-aangehouden-in-onderzoek-naar-hackersgroep-shinyhunters.html","by":"Dutch Police","date":"2026-09-29"},{"kind":"news","title":"Verdachte ShinyHunters wilde mogelijk ook twee moorden laten plegen","url":"https://nos.nl/artikel/2633007-verdachte-shinyhunters-wilde-mogelijk-ook-twee-moorden-laten-plegen","by":"NOS","date":"2026-09-29"}],"started":"2026-02-05","closed":null,"created":"2026-11-03T20:23:58.169Z","updated":"2026-11-03T20:23:58.169Z","cve_notes":[],"timeline":[{"at":"2026-11-03","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Status at this record’s cutoff: Odido’s undated FAQ puts the final total at approximately 6.39 million people. It says notification-related data analysis is complete and all identified affected customers have been contacted.","url":"https://www.odido.nl/veiligheid-eng","by":"Odido","patch":null},{"at":"2026-09-29","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Police confirmed that a 24-year-old Amsterdam man had been arrested on 15 September in the wider ShinyHunters investigation. They explicitly said this was not an arrest in the Odido case, which still needed further evidence.","url":"https://www.politie.nl/nieuws/2026/september/29/11-verdachte-aangehouden-in-onderzoek-naar-hackersgroep-shinyhunters.html","by":"Dutch Police","patch":null},{"at":"2026-09-07","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Police released a suspected caller’s voice recording and sought help identifying him. They confirmed that the criminals published stolen data after Odido refused their ransom demand.","url":"https://www.politie.nl/nieuws/2026/september/7/11-politie-deelt-stem-van-verdachte-in-onderzoek-naar-hack-odido.html","by":"Dutch Police","patch":null},{"at":"2026-07-13","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"RDI updated its statement: ACM would investigate Odido’s duty to protect customer information alongside RDI. AP would focus on how long customer data had been retained.","url":"https://www.rdi.nl/actueel/nieuws/2026/03/26/rdi-en-ap-starten-onderzoek-naar-aanleiding-van-het-incident-bij-odido","by":"RDI","patch":null},{"at":"2026-05-26","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Odido warned about fraudulent texts threatening to block subscriptions unless recipients verified their identity through a link. It did not establish whether this campaign used the stolen records.","url":"https://www.odido.nl/veiligheid/cyberaanval","by":"Odido","patch":null},{"at":"2026-03-26","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Dutch regulators RDI and AP announced investigations into customer-system security and data retention. Their statement confirmed that stolen customer data had been published online.","url":"https://www.rdi.nl/actueel/nieuws/2026/03/26/rdi-en-ap-starten-onderzoek-naar-aanleiding-van-het-incident-bij-odido","by":"RDI","patch":null},{"at":"2026-02-12","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"Odido publicly disclosed the customer-contact-system breach. BleepingComputer reported an initial estimate of 6.2 million affected customers, notification emails being sent and a report to the Dutch privacy regulator.","url":"https://www.bleepingcomputer.com/news/security/odido-data-breach-exposes-personal-info-of-62-million-customers/","by":"BleepingComputer","patch":null},{"at":"2026-02-05","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"According to Odido’s later account, attackers impersonated IT staff when contacting customer service on 5 and 6 February. They stole customer data before their access was revoked.","url":"https://www.odido.nl/veiligheid/cyberaanval","by":"Odido","patch":"na"}],"url":"https://hard.fyi/live/odido-customer-data-theft-feb-2026/","json":"https://hard.fyi/api/live?id=odido-customer-data-theft-feb-2026"}