Odido Data Breach: Millions of Customers Affected

Dutch telecom provider Odido has suffered a significant data breach impacting approximately 6.2 million customer accounts. The breach, discovered in early February 2026, exposed sensitive personal information, raising concerns about potential fraud and identity theft. This incident is considered one of the largest data breaches in the Netherlands to date.

What Happened?

Hackers gained access to Odido’s customer contact system through phishing attacks targeting employee accounts [Cybernews]. Once inside, they exfiltrated personal data from millions of accounts. The attackers have reportedly demanded a ransom, threatening to publish the stolen data [Erasmus University Rotterdam].

What Data Was Compromised?

The stolen data includes a wide range of personal information, such as:

• Names
• Addresses
• Phone numbers
• Bank details (IBANs)
• Birth dates
• Identification document information (passport numbers) [De Telegraaf]

Notably, passwords, call records, location data and billing information were not compromised [DutchReview].

What are the Risks?

The compromised data poses several risks to affected customers:

• Phishing Attacks: Criminals can use the stolen information to launch highly targeted phishing attacks, crafting convincing emails or SMS messages to trick individuals into revealing further personal details [De Telegraaf].
• Identity Fraud: Stolen passport numbers increase the risk of identity fraud, as this information is often used for verification purposes [De Telegraaf].
• Financial Fraud: Bank details could be used for fraudulent transactions or to obtain unauthorized loans or subscriptions [De Telegraaf].

What Should Customers Do?

Odido and cybersecurity experts recommend the following steps:

• Change Passwords: Immediately change your Odido account password and any other accounts where you use the same password. Use strong, unique passwords and consider using a password manager [De Telegraaf].
• Enable Two-Factor Authentication (2FA): Activate 2FA wherever possible for added security.
• Monitor Bank Accounts: Check your recent bank transactions and notify your bank about the data breach. Ask them to be vigilant for suspicious activity [De Telegraaf].
• Be Wary of Suspicious Communications: Be cautious of unsolicited emails, SMS messages, or phone calls requesting personal or financial information. Do not click on links from unknown sources and verify requests through Odido’s official customer service channels [De Telegraaf].
• Report Suspicious Activity: Report any suspicious activity to your bank and the police. Consider contacting the Fraudehelpdesk and the Autoriteit Persoonsgegevens for advice and reporting options [De Telegraaf].
• Consider Identity Monitoring: Explore identity monitoring services or credit checks to monitor your data for misuse.

The Human Factor in Cybersecurity

Experts emphasize that the breach highlights the importance of the human factor in cybersecurity. Phishing attacks exploit human vulnerabilities, and even the most robust digital defenses can be bypassed if employees are not vigilant [Erasmus University Rotterdam]. Cyber hygiene and employee awareness training are crucial.