NewsCompaniesFlawsGuides
Get the app
HighUpdated

Odido IT impersonation breach exposed about 6.39 million people’s customer data

Attackers posing as IT staff stole data on about 6.39 million current and former Odido and Ben customers. The data was later published. Ask Odido what was exposed and verify unexpected calls and messages through its official app or website.

What to do

If you are a current or former Odido or Ben customer, contact Odido through its official website to ask which details were exposed. Treat unexpected messages cautiously, and use ‘Check je Gesprek’ in the Odido app to verify callers claiming to represent Odido. Do not follow texts asking you to verify your identity to prevent your subscription being blocked.

What’s happening

Attackers impersonating IT staff targeted Odido customer service on 5 and 6 February 2026 and stole customer-contact records. Odido attributes the attack to ShinyHunters. Initially reported as affecting 6.2 million customers, its completed notification analysis puts the total at approximately 6.39 million people, including current and former Odido and Ben customers; Simpel was unaffected. Depending on the person, records included contact details, bank account numbers, dates of birth and identification details. Odido says account passwords and identity-document scans were excluded, although some telephone verification code words leaked and their use was stopped. Odido revoked access and says all identified affected customers were contacted. Police confirm the criminals published data after Odido refused to pay. Regulators opened security and retention investigations. A September ShinyHunters arrest was explicitly separate from the Odido case. The reviewed sources do not establish recovery or deletion of the published data, or a concluded Odido criminal case.

What
Breach
Affects
Odido and Ben customer services in the Netherlands
Fixed in
Nothing to patch
Since
5 Feb 2026

Timeline

  1. Update

    Status at this record’s cutoff: Odido’s undated FAQ puts the final total at approximately 6.39 million people. It says notification-related data analysis is complete and all identified affected customers have been contacted.

  2. Update

    Police confirmed that a 24-year-old Amsterdam man had been arrested on 15 September in the wider ShinyHunters investigation. They explicitly said this was not an arrest in the Odido case, which still needed further evidence.

  3. Update

    Police released a suspected caller’s voice recording and sought help identifying him. They confirmed that the criminals published stolen data after Odido refused their ransom demand.

  4. Update

    RDI updated its statement: ACM would investigate Odido’s duty to protect customer information alongside RDI. AP would focus on how long customer data had been retained.

  5. Update

    Odido warned about fraudulent texts threatening to block subscriptions unless recipients verified their identity through a link. It did not establish whether this campaign used the stolen records.

  6. Update

    Dutch regulators RDI and AP announced investigations into customer-system security and data retention. Their statement confirmed that stolen customer data had been published online.

  7. Made public

    Odido publicly disclosed the customer-contact-system breach. BleepingComputer reported an initial estimate of 6.2 million affected customers, notification emails being sent and a report to the Dutch privacy regulator.

  8. UpdateNothing to patch

    According to Odido’s later account, attackers impersonated IT staff when contacting customer service on 5 and 6 February. They stole customer data before their access was revoked.

Sources

  1. Update over de cyberaanval — current undated FAQOdido
  2. Update about cyberattack — current undated English FAQOdido
  3. Odido data breach exposes personal info of 6.2 million customersBleepingComputer · 12 Feb 2026
  4. RDI en AP starten onderzoek naar aanleiding van het incident bij OdidoRDI · 26 Mar 2026
  5. Politie deelt stem van verdachte in onderzoek naar hack OdidoDutch Police · 7 Sept 2026
  6. Verdachte aangehouden in onderzoek naar hackersgroep ShinyHuntersDutch Police · 29 Sept 2026
  7. Verdachte ShinyHunters wilde mogelijk ook twee moorden laten plegenNOS · 29 Sept 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from February 2026 · JSON · RSS