The Call That Opened the Ledger: ShinyHunters and the Odido Breach

On February 12, 2026, Odido told the Netherlands that the phone network was still standing and the customer file was not.

The company — the country’s largest mobile operator, the business that had absorbed T-Mobile Netherlands, Tele2, Ben, and Simpel — said it had been hit by a cyberattack. The sentence that mattered was narrower than the headline. The intrusion had reached a customer contact system used by Odido. It had not, the company said, taken Mijn Odido login passwords, call logs, location data, or billing records. What it had taken was the thing a call center actually lives on: the record of who the customer is.

That record, for roughly 6.2 million people, included names, addresses, mobile numbers, email addresses, dates of birth, and in many cases IBANs and government identity numbers — passport, driver’s license, and European national ID numbers, with validity periods. Have I Been Pwned would later verify a dump of 6,077,025 unique email addresses and list the same classes of data, including customer-service comments. A country of about eighteen million people had just watched a third of its adult life get indexed by a helpdesk database.

The phones still worked. That was the cruel part. Nobody needed to take down a cell tower to steal a nation-scale identity file. They needed someone inside the building who answered the phone.

What Odido Was Protecting — and What It Wasn’t

Odido is not a startup with a forgotten S3 bucket. It is the successor brand of T-Mobile’s Dutch business, a consumer and business carrier whose customer base is large enough that a single CRM export is a demographic event. Its brands still sit in Dutch pockets under more than one name. A breach of the parent contact system is therefore not a breach of one logo. It is a breach of the people who stayed when the logos changed, including, reporting later noted, people who were no longer customers. Retention is a privacy decision. In February 2026 it became an exposure decision.

The system that was hit was not the radio network, the core billing platform, or the subscriber authentication that lets a handset join the network. Odido’s own notice, quoted across contemporaneous reporting, was specific: personal data from a customer contact system. The items the company said were not included are as important as the items that were:

• Mijn Odido login passwords were not in the stolen set.
• Call history and location data were not in the stolen set.
• Billing and invoice information were not in the stolen set.
• Scans of identity documents were not in the stolen set.

What was in the set was enough to impersonate both the customer and the company. A name, a date of birth, an address, a mobile number, an email, an IBAN, and a passport or driver’s-license number is not “contact data” in any ordinary sense. It is the packet a bank, a benefits office, or a second carrier asks for when it wants to know that you are you. Customer-service comments, listed by Have I Been Pwned among the exposed classes, are worse in a quieter way. They are the notes a human wrote about a human: a dispute, a bereavement, a complaint, a verification answer.

Odido also warned about a field that looked like a password and was not one. Reporting on the company’s notice described a password_c value that could appear in the breach — not a login secret, but a historical challenge word used when someone called in and had to prove they were the account holder. Stealing the answer to the security question is a second breach waiting inside the first.

The Weekend the Ledger Moved

The public timeline is short, and that is part of the story.

Reuters and Odido’s notice placed the detection in the weekend of February 7–8, 2026. Suspicious activity was seen. Unauthorized access to the contact system was cut off. The Dutch data protection authority, the Autoriteit Persoonsgegevens, was informed. External investigators were brought in. On February 12, customers were told.

That is a fast disclosure by the standards of a telecom breach. It is also a disclosure that arrived after the data had already moved. A contact system is built to answer questions quickly. Export is a feature. Once an account that is allowed to look up customers is allowed to look up many customers, the difference between a shift and a theft is volume, and volume is easy to miss if the logs say the right username did the right kind of work.

Media reconstruction of the path in — reported by Cybernews, SecurityWeek, and later by Dutch police commentary carried in Security Affairs — is consistent even where the company’s first notice stayed quieter. The intrusion did not begin with a zero-day in a base station. It began with people who answer phones for a living.

Call-center and customer-service staff were targeted with phishing aimed at login credentials. A follow-on vishing call, in which a Dutch-speaking caller impersonated IT support, was used to induce the approval that got past the extra authentication step. Some outlets described the destination as a CRM, and some mentioned Salesforce specifically. Odido’s confirmed fact is narrower and sufficient: a customer contact system, reached through accounts that were supposed to be there, used to download data that was supposed to stay there.

This is the attack class defenders already have a name for and still routinely lose to. Valid accounts. Once the login is real, the rest of the intrusion looks like work. A query is a query. An export is an export. The firewall is not the control that fails. The control that fails is the assumption that a person who can see one customer can be trusted with all of them, and that a phone call from “IT” is a better authenticator than the hardware key nobody issued to the night shift.

Who Claimed It, and Who the Police Suspected

ShinyHunters claimed the breach. The name is not new to this archive. The group, and the looser ecosystem of affiliates and brands around it, has spent years turning stolen SaaS and support data into extortion: demand payment, and if the victim refuses, publish in batches so the pressure renews itself. Have I Been Pwned’s verified Odido entry attributes the incident to ShinyHunters and points to Dutch reporting that the stolen set was pushed to the dark web after an extortion attempt. Security Affairs reported on March 2, 2026 that ShinyHunters had leaked the full Odido dataset. The HIBP description is more precise about the shape of the leak: about six million unique email addresses, published across four separate releases on consecutive days, beginning around March 1.

An early Have I Been Pwned listing in late February counted a few hundred thousand accounts. That was not the breach shrinking. It was the breach being metered. Extortion crews publish samples, then more, then the rest. Each tranche is a message to the victim and a product for everyone else.

Odido did not pay. The data went out anyway. That is the arithmetic of data-only extortion, and it is why “we have backups” is not a response to this class of incident. There was nothing to decrypt. The asset was the copy.

Five months later the attribution picture grew a second layer. On July 13, 2026, Security Affairs reported that Dutch authorities suspected Dutch nationals in the hack. The investigative detail that carried the suspicion was human, not cryptographic: a Dutch-speaking caller who had impersonated an IT employee to get the first approval. The High Tech Crime Team was investigating. A local voice does not disprove a ShinyHunters claim. The brand has long worked through affiliates, rented access, and operators who are not sitting in one room. It does mean the initial access was close enough to sound like it belonged on the floor it was calling.

Both facts can be true at once, and neither has been settled in a courtroom in the public record this archive is using. What is settled is the outcome. The contact file left the building. The network did not have to fall for that to happen.

What 6.2 Million Records Are For

A stolen telecom CRM is not a list of email addresses. It is a script.

The follow-on crime does not require the attacker to break Odido a second time. It requires them to sound like Odido the first time they call the customer. The company warned, in the days after disclosure, that criminals would use the stolen set to impersonate Odido and other firms by phone, text, and email. It specifically told customers that messages asking them to install an app update from an external link were not from Odido, and that the company would not ask for that. That warning only exists because the attacker now knows the customer’s name, number, and enough account detail to make the lie specific.

An IBAN plus a date of birth plus a passport number is a different crime from a marketing list. It is the material of account takeover at banks, of fraudulent direct debits, of new lines of credit opened in a name the victim still thinks is private. Odido told customers it did not believe they needed to change bank account numbers solely because of the breach. That is a reasonable operational statement and a poor emotional one. The number does not have to be changed for it to be useful. It has to be known.

Government ID numbers are worse because they are sticky. A password can be rotated. A passport number can be reissued, slowly, expensively, and only if someone notices it has been used. The Dutch privacy regulator’s interest in the case is not ceremonial. Under the GDPR, a telecom that holds identity documents and bank details in a system reachable by social-engineered staff accounts is holding special-risk data behind a general-purpose door.

The inclusion of former customers sharpens the failure. A person who left Odido years ago still had a row in the system that was exported. Data minimization is usually discussed as a compliance slogan. Here it is a blast-radius control. Every retained passport number is a future victim who no longer has a reason to read Odido’s status page.

Why This Keeps Working

The Odido intrusion belongs to a family this archive has already documented under other names. The 2020 Twitter takeover was a vishing call to employees who could reach an admin tool. The Lapsus$ cases of 2022 were helpdesk and identity abuse more often than they were malware. The 2023 casino incidents were social engineering against people whose job was to reset access for other people. ShinyHunters’ own recent run — support portals, Salesforce tenants, CI systems — is the same idea pointed at whatever database a company has concentrated in one SaaS login.

The structural facts at Odido are the ones that repeat:

1. The valuable data lived in the system built for talking to customers, not in the system built for running the network.
2. The people with access to that system are trained to be helpful, and are reached all day by strangers.
3. A second factor that can be approved by a convinced employee is not a second factor. It is a second conversation.
4. Bulk export was possible from an account whose ordinary job is lookup.
5. Extortion did not need encryption. Publication was the leverage, and publication happened in batches so the story could not end on the day of disclosure.

None of those facts requires a novel exploit. That is why they survive patching. You cannot CVE a business process in which a Dutch-speaking caller says he is from IT and a tired agent approves the prompt.

What the Dump Actually Contains

Have I Been Pwned’s verified Odido entry is the closest thing the public has to a field list that is not a press sentence. It counts 6,077,025 unique email addresses and names the classes that showed up in the published set: names, dates of birth, physical addresses, phone numbers, email addresses, bank account numbers, government identity numbers, and customer-service comments. That last class is the one a headline skips. A comment field is where an agent writes the thing the form did not have a box for. A bereavement. A fraud flag. The answer a customer gave when asked to prove they were themselves. Once that text is in a dump, it is not metadata. It is a script for the next call.

Odido’s own notice, as carried by BleepingComputer and by the company’s safety page, drew a line the dump does not erase. Mijn Odido login passwords were not in the set. Call history was not. Location data was not. Invoices were not. Scans of identity documents were not. The distinction is real and it is easy to misread. “No passwords” does not mean “no secrets.” A passport number with a validity period is a secret the customer cannot rotate over a weekend. An IBAN is a secret in the practical sense that the person who has it can start a conversation with a bank that the person who does not have it cannot. Odido told customers it did not believe they needed to change bank account numbers solely because of the breach. That is an operational judgment about fraud controls at the banks, not a claim that the number is still private.

The password_c field belongs in the same paragraph. Reporting on Odido’s notice described it as a historical challenge word used when a caller had to prove they were the account holder — not a login password for Mijn Odido. Challenge words are the leftover of a helpdesk that authenticated people by asking them something only they should know. After a contact-system export, the attacker knows it too. Any process that still treats that word as proof is now a process the thief can pass.

Former customers make the minimization failure concrete. Reporting noted that people who were no longer with Odido still had rows in the system that left. A person who switched carriers years ago does not read Odido’s status page. They do not expect a February email from a brand they left. They are the easiest targets in the set, because the warning never reaches them and the facts in the row are still true.

Four Releases, One Demand

The leak was not a single event. Have I Been Pwned’s description of the verified dump is specific about the shape: the addresses went out across four separate releases on consecutive days, beginning around March 1, 2026. An earlier listing, in late February, had counted a few hundred thousand accounts. That was not the breach shrinking. It was the breach being metered. Security Affairs reported on March 2 that ShinyHunters had leaked what it called the full Odido dataset after an extortion attempt. Dutch coverage carried by HIBP said the same thing in the language of a newsroom rather than a tracker: the stolen set was pushed out after Odido did not pay.

Staged publication is the product. A sample proves the thief has the file. A second tranche proves the first was not the whole file. A third and a fourth keep the story in the press and on the victim’s board agenda after the initial disclosure has started to fade. Encryption is unnecessary. The lever is the copy, and the copy can be shown again. Odido’s refusal did not restore confidentiality. It did refuse to set a price that the next Dutch company would be quoted. Both sentences are true. Defenders who treat “we didn’t pay” as the end of the incident are reading only one of them.

The follow-on crime does not require a second intrusion into Odido. It requires a phone call that sounds like Odido. The company warned, in the days after disclosure, that criminals would impersonate Odido and other firms by phone, text, and email, and that messages asking customers to install an app update from an external link were not from Odido. That warning exists because the attacker now knows enough to make the lie specific: the right name, the right number, a date of birth, sometimes an IBAN, sometimes a document number. Specificity is what makes a phishing call work after a decade in which everyone has been told not to trust a generic one.

What the Police Can Settle, and What They Cannot

The July reporting and the March claim do not have to be forced into one sentence. A local voice does not disprove a ShinyHunters brand, and a leak-site post does not prove that the person on the phone was sitting with the people who published the file. Initial access can be local. The extortion brand can be imported. Affiliates, rented access, and operators who are not one crew in one jurisdiction are how this ecosystem has worked for years. The archive keeps the layers separate until a charging document joins them.

What does not depend on that document is the control failure. Some outlets described the destination as a CRM and some named Salesforce. Odido’s confirmed fact is the one that should drive the review: a customer contact system, reached through accounts that were supposed to be there, used to download data that was supposed to stay there. If a later report pins the tenant to a particular product, that is a vendor-control question. It is not required to explain the outcome. The outcome is a lookup right that could become an export, and a second factor that a convinced employee could approve. Odido’s version of a familiar helpdesk intrusion is notable because the database behind the login was a nation’s worth of identity facts, sitting in a system whose job was to answer the phone.

What Would Have Changed the Weekend

The controls that would have changed February 7 are not exotic, and they were not in place in a way that stopped the export. Phishing-resistant authentication for the people who can see customer records — hardware-bound, not a push that a voice on the phone can talk someone through. A hard ceiling on how many customer rows one account can export in an hour, with a page to a human when the ceiling is touched. Out-of-band verification for any IT request that asks an agent to approve a prompt, reset a factor, or install a tool, using a channel the caller cannot specify. Separation between the right to look up one customer and the right to take the file. Retention limits that delete the passport number of a person who left, instead of keeping it because a future call might ask for it.

None of those controls unpublish four releases. They are the reason the next contact-system breach does not have to be this large. Odido’s immediate response was the one the playbook demands and cannot finish. Access was terminated. Investigators were engaged. The Autoriteit Persoonsgegevens was informed. Customers were told not to click, not to install, not to treat a caller who knows their date of birth as proof of anything. That is containment of the relationship. It is not containment of the file.

The Cleanup That Does Not Restore the File

Odido’s immediate response was the one the playbook demands and the one the playbook cannot finish. Access was terminated. Investigators, internal and external, were engaged. The regulator was notified. Customers were warned not to click, not to install, not to treat a caller who knows their date of birth as proof of anything. Phishing-resistant authentication, least privilege on export, and out-of-band verification for IT requests are the controls that would have changed the weekend of February 7. They do not unpublish a dump that has already crossed four releases.

The criminal investigation is the other unfinished sentence. If the July reporting holds — local suspects, a voice on a phone, a contact system rather than a core network — then the Odido case will be remembered less as a telecom hack than as a helpdesk hack with a telecom’s address book. The mast was never the target. The mast was the brand the attacker borrowed after the export.

Six million people now have to treat their own facts as compromised credentials. The network, as Odido was careful to say, kept working. The ledger did not.

---

Attack Chain: ShinyHunters — Odido Customer Contact System

graph TD
    A["Reconnaissance\nShinyHunters-linked operators\ntarget Odido customer-service staff\nnot the mobile core network"] --> B["Phishing for Credentials\nEmails aimed at call-center\nand CS logins — Feb 2026\nmedia reconstruction"]
    B --> C["Vishing\nDutch-speaking caller impersonates\nIT support and induces the\napproval that passes the extra\nauthentication step"]
    C --> D["Valid Account\nStolen employee login reaches\nthe customer contact / CRM system\nActivity looks like ordinary work"]
    D --> E["Collection\nMass query and export of the\ncontact file: names, addresses,\nphones, emails, DOB, IBANs,\npassport and license numbers"]
    E --> F["Detection\nWeekend of Feb 7–8, 2026\nOdido cuts access, calls in\ninvestigators, notifies the AP"]
    F --> G["Disclosure\nFeb 12, 2026: Odido confirms\n6.2 million people affected\nPasswords, call logs, location,\nand billing not in the set"]
    G --> H["Extortion and Release\nShinyHunters demands payment\nOdido refuses\nFour staged dumps from March 1\nHIBP verifies 6,077,025 emails"]
    H --> I["Follow-on Fraud\nStolen facts used to impersonate\nOdido and other firms\nFake app-update lures\nChallenge words now known"]
    I --> J["Investigation\nJuly 13, 2026: Dutch police\nsuspect local nationals\nHigh Tech Crime Team\non the vishing call"]

    style A fill:#1a1a2e,color:#e0e0e0
    style C fill:#c0392b,color:#fff
    style E fill:#c0392b,color:#fff
    style H fill:#8e44ad,color:#fff
    style J fill:#2c3e50,color:#e0e0e0