The Odido Mega-Breach: When a Telecom Giant Refuses to Pay and Millions of Records Hit

One-Third of a Nation Exposed

In the annals of European data breaches, the Odido incident stands apart — not just for its scale, but for the ethical dilemma it forced and the precedent it set. When the Dutch telecommunications giant disclosed that threat actors had exfiltrated records belonging to 6.2 million customers — roughly one-third of the Netherlands’ 18.1 million population — it triggered a national conversation about data protection, corporate responsibility, and the impossible calculus of ransom payments.

Odido, formerly known as T-Mobile Netherlands before its September 2023 rebrand, is the largest mobile operator in the Netherlands by consumed minutes, with approximately 7 million customers across its Odido and Ben brands. The company was acquired by investment firms Apax Partners and Warburg Pincus from Deutsche Telekom and rebranded to shed its ties to the German parent company. The breach, attributed to the prolific threat group ShinyHunters, compromised a Salesforce-based customer relationship management (CRM) system that contained a comprehensive dataset: customer names, dates of birth, email addresses, phone numbers, physical addresses, IBAN bank account numbers, and critically, identification document numbers and expiry dates from passports, national ID cards, and driver’s licenses that customers had submitted for identity verification.

The scope of the exposed data makes this more than a typical breach. IBAN numbers enable bank fraud. Government identification document numbers — while not physical scans or copies of the documents themselves — provide the data needed to commit identity fraud, including opening accounts and applying for services in victims’ names. The combination of both, paired with comprehensive personal details, creates a near-complete identity package that can be exploited for years.

The ShinyHunters Attack

ShinyHunters is one of the most prolific data breach operators of the past several years. The group, believed to have formed in 2019, is responsible for confirmed breaches of Ticketmaster (560 million customer records in 2024), Santander Bank (30 million customer records in 2024), and AT&T (call metadata of nearly 110 million customers, also in 2024). The Ticketmaster and Santander breaches were both linked to the exploitation of Snowflake cloud environments using credentials stolen via infostealer malware — a pattern that underscores the interconnected nature of modern cybercrime.

The Odido breach, which occurred over the weekend of February 7-8, 2026, followed a different but equally effective playbook: social engineering. According to subsequent reporting, the attackers first obtained employee passwords through targeted phishing emails. They then called those same employees, impersonating Odido’s IT department, and convinced them to approve fraudulent multi-factor authentication login requests. This classic social engineering technique — phishing combined with voice-based impersonation — bypassed Odido’s MFA protections entirely without exploiting any technical vulnerability in the Salesforce platform itself.

Once inside, the attackers linked a malicious “connected app” to Odido’s Salesforce environment, which acted as a persistent access mechanism giving them direct access to the customer database. Reporting indicates the hackers were able to scrape the Salesforce database for approximately 48 hours before the unauthorized access was detected and terminated. During that window, they systematically exfiltrated customer records from Odido and its subsidiary brand Ben.

A Salesforce spokesperson clarified that the company had “no indication at this time that this issue was caused by any vulnerability in our platform.” The breach resulted entirely from the social engineering of Odido employees.

The Ransom Demand — and Refusal

After the breach was confirmed, Odido received a ransom demand from ShinyHunters: more than EUR 1 million for the deletion of the stolen data and a commitment not to publish it.

On the advice of leading cybersecurity advisors and relevant government agencies including the Dutch National Police, Odido’s board made the decision not to pay. The company publicly stated it would “not allow itself to be blackmailed.” The reasoning centered on several factors. First, there is no reliable way to verify that attackers actually delete stolen data after receiving payment — the data could be copied, shared with affiliates, or retained for future exploitation. Second, payment funds criminal operations and incentivizes future attacks. Third, the Netherlands’ National Police publicly reinforced the position, advising: “Our advice to ransomware victims is: don’t pay if criminals demand a ransom.”

The decision aligned with an emerging consensus among cybersecurity professionals and regulators that ransom payments for data breaches are fundamentally unreliable. Unlike ransomware attacks where payment produces a verifiable outcome (decryption of files), data breach ransoms offer only a promise — one made by criminals who have already demonstrated willingness to violate trust.

Four Days of Data Dumps

ShinyHunters responded to Odido’s refusal with a controlled release strategy designed to maximize pressure and public attention. Over four consecutive days beginning February 26, the group published the stolen data in staged tranches on dark web forums.

The first release on February 26 contained approximately 680,000 individual customer records and 320,000 business records — including names, home addresses, phone numbers, email addresses, and approximately 275,000 IBAN bank account numbers. Particularly alarming were internal customer service notes revealing payment issues, debt registrations, and fraud investigation details. ShinyHunters warned that additional data would be published over the following 16 days if Odido did not pay.

On February 27, another approximately 1 million lines of data were released, bringing the total published to 2 million lines across the first two days. The leaked data included bank account numbers and ID document details, generating substantial media coverage in the Netherlands.

February 28 brought the third consecutive release. This dump included approximately 365,000 driver’s license numbers, 245,000 European identity card numbers, and 180,000 passport numbers. RTL journalists also identified in this batch detailed internal customer service notes describing stalking, threats, domestic violence, and protected addresses — information that the national domestic violence center Veilig Thuis warned could directly affect victims’ physical safety.

March 1 completed the release with the remaining data, constituting what appeared to be the full cache. The complete dataset contained information on more than 6.5 million individuals and approximately 600,000 companies, including slightly more than 5 million unique identification document numbers from passports, driver’s licenses, and residence permits.

The staged release strategy served multiple purposes for ShinyHunters. It maintained media attention over an extended period, maximized embarrassment for Odido, demonstrated the completeness of the data to potential buyers, and served as a warning to future victims about the consequences of non-payment.

The Identity Document Crisis

The exposure of over 5 million government-issued identification document numbers represents the most consequential dimension of the Odido breach. While the breach did not include physical scans or copies of these documents — a fact Odido emphasized — the document numbers and expiry dates alone provide substantial material for identity fraud. In the Netherlands, as in most European countries, a passport or national ID card number is used routinely for identity verification. With these numbers, criminals can attempt to open bank accounts, apply for credit, or commit fraud in victims’ names.

Unlike passwords, which can be changed, or credit cards, which can be cancelled and reissued, a government ID number cannot be easily replaced or invalidated. The Dutch government does not routinely reissue identity documents in response to data breaches, and the document numbers remain usable for the document’s validity period.

The Dutch Public Prosecution Service launched a criminal investigation into the cyberattack on February 25, and the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) confirmed it was monitoring the situation. Meanwhile, scam websites quickly emerged targeting breach victims with fake compensation offers — the Consumentenbond identified at least one fraudulent site inviting victims to join a mass claim for EUR 50. The weaponization of the breach to target victims a second time through phishing and social engineering scams is a predictable but disturbing consequence.

Odido offered affected customers support through a dedicated incident page and support line, but consumer advocacy groups and security experts criticized these measures as insufficient given the severity and permanence of the exposure.

Telecom CRM Vulnerabilities: A Systemic Problem

The Odido breach is not an isolated incident but a symptom of a systemic vulnerability in the telecommunications industry. Telecom operators, by the nature of their business, maintain some of the most comprehensive customer databases in any sector. Regulatory requirements for identity verification, billing, and law enforcement cooperation mean that telecom CRM systems contain exactly the combination of personal, financial, and identity data that makes them high-value targets.

Several factors compound the risk. Many telecom CRM platforms aggregate data from multiple business processes — customer onboarding, billing, customer service, partner integrations — creating monolithic databases where a single point of compromise exposes everything. The volume of legitimate data access from customer service representatives, automated processes, and third-party integrations makes it difficult to distinguish malicious queries from normal operations.

The industry has suffered repeated major breaches in recent years. T-Mobile US experienced breaches in 2021 (40 million records), 2022, and 2023 (37 million records), resulting in a $350 million class-action settlement and a $15.75 million FCC penalty. Optus in Australia exposed data for 9.8 million customers — one-third of Australia’s population — in 2022 through an unprotected, publicly accessible API. AT&T confirmed in 2024 that call and text metadata for virtually all its 110 million customers had been compromised through a breach of its Snowflake cloud environment.

The pattern suggests that the telecom industry needs a fundamental reassessment of how customer data is stored, segmented, and protected. The practice of maintaining comprehensive customer profiles in monolithic databases — where a single compromise exposes everything — is increasingly untenable in the current threat environment.

Lessons and Implications

The Odido breach offers several lessons that extend beyond the telecom sector.

The Ransom Payment Debate

Odido’s refusal to pay set a visible precedent backed by Dutch law enforcement. But the decision was not without cost. The four-day data dump caused significant harm to millions of customers whose identity document numbers, bank details, and in some cases domestic violence records are now circulating on dark web markets. The counterargument — that payment provides no guarantee and funds criminal enterprise — is sound, but cold comfort to the individuals affected.

This tension will not be resolved by individual corporate decisions. It requires policy clarity from regulators about whether and when ransom payments are acceptable, legal frameworks that protect organizations from liability for refusing payment, and investment in the identity infrastructure that makes stolen document numbers less useful for fraud.

Data Minimization

The breach’s severity was amplified by the volume and sensitivity of data Odido retained. The fact that the CRM system contained not only identity document numbers for over 5 million people but also sensitive internal notes about domestic violence situations and protected addresses raises serious questions about data minimization practices. A principled application of the GDPR’s data minimization principle — storing only the data necessary for current business purposes — would have reduced the blast radius.

Social Engineering Remains the Weakest Link

Despite Odido having multi-factor authentication in place, the attackers bypassed it through voice-call impersonation of IT staff — a technique that requires no technical sophistication, only social manipulation skills. This underscores that human factors remain the primary vulnerability in most organizations’ security posture, and that MFA alone is not sufficient without phishing-resistant authentication methods and robust security awareness training.

Regulatory and Legal Consequences

The Odido breach will test the practical enforcement mechanisms of GDPR. With 6.2 million affected individuals — roughly one-third of the national population — the regulatory response will set precedents for how European authorities handle mega-breaches. Odido had already been fined EUR 1.5 million by the Rijksinspectie Digitale Infrastructuur for prior security infringements, and this far larger incident could attract substantially greater penalties under GDPR’s framework of up to 4% of annual global turnover. The Dutch Public Prosecution Service’s criminal investigation adds another dimension of legal exposure.

The Odido case will be studied for years as a defining example of the modern data breach: massive scale, sensitive data, social engineering as the entry vector, criminal extortion, ethical dilemmas, and consequences that extend far beyond the breached organization to affect millions of individuals and the broader trust in digital services.

Frequently Asked Questions

Sources & Further Reading

• Odido Informs Customers of Cyber Attack — Odido Newsroom
• Dutch Telco Odido Admits 6.2M Customers Affected in Breach — The Register
• Hackers Publish Full Cache of Stolen Odido Customer Data After Ransom Refusal — NL Times
• Odido Salesforce Hack: Up to 6M Customers’ Data at Risk — Salesforce Ben
• Major Hack of Dutch Telco Odido Was a Classic Case of Social Engineering — Techzine
• Odido Data Breach Escalates Into Criminal Probe — Cybernews
• Dutch Cops Back Odido as ShinyHunters Leaks Continue — The Register