Odido cyberattack exposes personal data of 6.2 million customers in the Netherlands

Odido, one of the largest telecommunications providers in the Netherlands, has disclosed that the recent cyberattack exposed personal data belonging to 6.2 million customers, marking one of the country’s most significant data breaches to date.

The company detected suspicious activity over the weekend of Feb. 7 and immediately launched an investigation with internal and external cybersecurity experts. The probe determined that attackers gained unauthorized access to a customer contact system, enabling them to download large volumes of personal information.

Odido confirmed that the compromised data may include customers’ full names, addresses, places of residence, mobile numbers, customer numbers, email addresses, IBAN bank account numbers, dates of birth and identification data such as passport or driver’s license numbers and their validity periods. The company emphasized that passwords, call logs, location data, billing details and scanned copies of identification documents were not affected.

“Odido has been hit by a cyberattack, which compromised customer data,” the company said in a statement to customers. “This involved personal data from a customer contact system used by Odido. No passwords, call logs, or billing information were affected.”

Threat actors contacted the company claiming responsibility for the theft of millions of records. At this stage, there is no indication that the stolen data has been publicly released.

Odido said it terminated unauthorized access to the affected system shortly after detecting the breach. The company has reported the incident to the Dutch Data Protection Authority and stated that it is safe for customers to continue using their mobile services.

All affected customers are being notified by email and are expected to receive communication within 48 hours. The company has also implemented additional security measures, strengthened monitoring for suspicious activity and engaged external cybersecurity specialists to support its response and mitigation efforts.

Formed in 2023 through the rebranding of T-Mobile Netherlands and Tele2 Netherlands, Odido serves approximately 8 million customers nationwide with mobile, broadband and television services. The company, acquired in 2021 by private equity firms Apax and Warburg Pincus, competes with major Dutch telecom providers including KPN and VodafoneZiggo.