Odido Telecom, one of the largest telecommunications providers in the Netherlands, has confirmed that it has suffered a serious cyberattackin which hackers gained access to personal data of around 6.2 million customer accounts. The incident is one of the largest data breaches recorded in the Dutch telecommunications industry recently and has raised concerns about possible fraud and phishing attacks.
The breach was detected over the weekend of February 7-8, with the company emphasizing that, despite the data leak, there was no disruption to mobile, internet or television services.
How the attack happened: Infiltration of the company's CRM
According to initial information, the attackers managed to breach Odido Telecom's customer relationship management (CRM) system , downloading sensitive information before the company managed to block unauthorized access.
See also: Conpet: Ransomware attack led to data theft
Interestingly, the perpetrators themselves notified the company, claiming to have millions of customer files. So far, no known ransomware group has claimed responsibility, and as of February 12, the data had not appeared publicly online or on the dark web.
Who is affected: Huge portion of the customer base
The incident concerns a large percentage of Odido subscribers, which offers mobile telephony, broadband and television content to both individuals and businesses.
The company, which is owned by investment groups Apax Partners and Warburg Pincus, assured that basic functions remain fully active and that customers can continue calling, browsing and streaming normally without problems.
Odido Telecom: What data was leaked and what wasn't
Odido Telecom announced that the information exposed includes highly sensitive personal information, such as:
- full names and addresses
- mobile phone numbers
- customer numbers and emails
- IBAN bank accounts
- dates of birth
- government identification information, such as passport or driver's license numbers
See also: Google: Hackers target global defense industry
However, the company stressed that no passwords for the “My Odido” portal, call logs, location data, billing information or scans of identity documents. This reduces the risk of direct access to accounts, but does not eliminate the possibility of misuse of the data.
Customer information and EU compliance
Odido Telecom has initiated a process of notifying affected customers via email from info@mail.odido.nl or via SMS, providing details of the impact in each case.
At the same time, the breach has been reported to the Dutch Data Protection Authority (AP), as required by the GDPR and the European regulatory framework.
Phishing and phishing scam risks
Experts warn that this data could be exploited in attacks social engineering, such as impersonation scams, fake invoices or targeted phishing emails impersonating Odido Telecom, banks or government agencies.
Customers are urged to be particularly vigilant against unsolicited calls or messages, to carefully check sender domains, typographical errors, and to confirm numbers only through official websites.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: New ClickFix attacks infect systems with LummaStealer
The company's next steps
Odido Telecom immediately hired external cybersecurity experts to strengthen defenses, improve monitoring and train staff. CEO Søren Abildgaard said the company was “deeply sorry” and committed to limiting the consequences, providing full support to customers.
The incident highlights how vulnerable the telecommunications sector remains, as customer databases are one of the most valuable targets for cybercriminals.
