Dutch telco Odido reports breach of 6.2 million customer records

In a statement released on Thursday, Dutch telecommunications company Odido confirmed that a data breach has affected millions of its customers. According to the company, hackers gained access to its customer contact system and downloaded customer information. A spokesperson for Odido stated that the breach affects more than 6.2 million customers, which represents about a third of the Dutch population.

The security incident affects customers of both Odido and its subsidiary, Ben NL. However, both companies confirmed that their phone, internet, and television operations were unaffected by the breach. Odido also asserted that the data does not affect business customers.

According to Odido, the compromised customer contact system contained specific types of user data:

• Stolen data: Customer names, phone numbers, postal and email addresses, dates of birth, bank account numbers (specifically the International Bank Account Number, or IBAN), and details of government-issued IDs, such as passport or driver’s license numbers and dates of validity.
• Unaffected data: Customer call records, location data, billing information, and image scans of government IDs.

The company noted that former customers who had service within the past two years may also be affected by the breach.

This incident is part of a broader pattern of data thefts targeting telecommunications providers. Earlier this week, the Singaporean government confirmed that a hacking group had previously broken into four of the country’s top phone giants as part of a surveillance operation, though the group did not access customers’ personal information.

Additionally, hackers associated with the China-backed threat group known as Salt Typhoon have hacked hundreds of phone companies. These cyber espionage campaigns have targeted telecommunications providers in Canada, Norway, the United Kingdom, and the United States.

Why it matters

The breach at Odido is part of a broader trend of data thefts targeting telecommunications companies by both financially motivated hackers and state-backed espionage groups.