Data breach
Odido data breach
In 2026, Odido suffered a data breach affecting 8,123,927 records. Exposed data included names, surname, addresses and 6 other types of data.
Breach date
8.1 million
Records in the breach
9
Types of data exposed
Were you affected by the Odido breach?
Enter your email address to see whether it appears in this breach — or any of the other breaches in Leak Database.
Data exposed in the Odido breach
- Names
- Surname
- Addresses
- Email Addresses
- Phone Numbers
- Date of Birth
- Gender
- Service Notes
- Identity Numbers
About the breach
The Odido Data Breach in February 2026 exposed the personal data of approximately 6.39 million current and former customers of Dutch telecom operator Odido and its sub-brand Ben.
What Happened
• Vector: Attackers used social engineering to impersonate an IT employee on a phone call to Odido’s helpdesk, capturing credentials and a multi-factor authentication (MFA) token.
• Access: Using the stolen credentials, intruders accessed Odido’s Salesforce CRM environment on February 7–8, 2026, and exfiltrated roughly 90 GB of customer records via legitimate APIs.
• Extortion and Leak: After Odido refused to pay a ransom demand, the ShinyHunters hacker group published the full dataset on the dark web on March 1, 2026.
What Data Was Exposed
• Names, physical addresses, phone numbers, and email addresses
• Dates of birth, gender, and customer service notes/records
• Bank account numbers (IBANs)
• Government-issued ID numbers (passports, driver's licenses, European national ID numbers)
• Note: Account login passwords were not leaked; however, telephone verification "challenge words/code words" stored in the CRM field password_c were exposed and subsequently discontinued.
Steps for Affected Customers
• Review Official Guidance: Read Odido's Update about Cyberattack for security recommendations, including free access to digital protection tools like F-Secure and verification features in the Odido app.
• Request Data Details: Users on Reddit note that affected individuals can submit a formal GDPR/AVG request via dpo@odido.nl or by post to Odido Netherlands B.V. to request a full overview of the specific data held and leaked.
What Happened
• Vector: Attackers used social engineering to impersonate an IT employee on a phone call to Odido’s helpdesk, capturing credentials and a multi-factor authentication (MFA) token.
• Access: Using the stolen credentials, intruders accessed Odido’s Salesforce CRM environment on February 7–8, 2026, and exfiltrated roughly 90 GB of customer records via legitimate APIs.
• Extortion and Leak: After Odido refused to pay a ransom demand, the ShinyHunters hacker group published the full dataset on the dark web on March 1, 2026.
What Data Was Exposed
• Names, physical addresses, phone numbers, and email addresses
• Dates of birth, gender, and customer service notes/records
• Bank account numbers (IBANs)
• Government-issued ID numbers (passports, driver's licenses, European national ID numbers)
• Note: Account login passwords were not leaked; however, telephone verification "challenge words/code words" stored in the CRM field password_c were exposed and subsequently discontinued.
Steps for Affected Customers
• Review Official Guidance: Read Odido's Update about Cyberattack for security recommendations, including free access to digital protection tools like F-Secure and verification features in the Odido app.
• Request Data Details: Users on Reddit note that affected individuals can submit a formal GDPR/AVG request via dpo@odido.nl or by post to Odido Netherlands B.V. to request a full overview of the specific data held and leaked.
How to protect yourself
In order to protect yourself, we recommend the following:
1. Monitor your credit report for any suspicious activities. If you cannot do this yourself, make use of any service that does this on your behalf.
2. Be on the lookout for an increase in number of spam or scam calls and emails. We recommend you make use of Apps like True Caller, which can assist you in identifying any possible spam or scam calls.
3. Be sure to monitor your bank account transactions. Ensure you receive real time notifications on any transaction.
1. Monitor your credit report for any suspicious activities. If you cannot do this yourself, make use of any service that does this on your behalf.
2. Be on the lookout for an increase in number of spam or scam calls and emails. We recommend you make use of Apps like True Caller, which can assist you in identifying any possible spam or scam calls.
3. Be sure to monitor your bank account transactions. Ensure you receive real time notifications on any transaction.
Get told about the next breach
A free Leak Database account emails you when your address appears in a newly added breach.