Dutch police say they have “multiple strong indications” that a local criminal gang was behind the massive data breach at telecom company Odido earlier this year. Investigators found that the attack began with a phone call: a Dutch-speaking man called Odido’s helpdesk pretending to be an IT employee, talked a staff member into logging in to a fake website, and used those credentials to steal the personal data of 6.2 million customers — roughly a third of the entire Netherlands. The stolen data, which included names, addresses, phone numbers, bank account numbers, and social security numbers (BSNs), was published on the dark web after Odido refused to pay a €1 million ransom.
This kind of attack — called social engineering — is a reminder that criminals often bypass high-tech defenses by simply calling and asking. If you are an Odido customer, your data was almost certainly exposed. Criminals can use this information to impersonate you, open accounts in your name, or send convincing phishing messages pretending to be your bank or other services.
How to check if you’re affected
Affected products include Odido mobile subscriptions, home internet plans, and any account held with Odido (formerly T-Mobile Netherlands) since before March 2026. If you have or had an Odido subscription, assume your data was included in the breach.
- Log in to your Odido account and check for any official breach notification message from the company.
- If you live in the Netherlands, place a fraud alert with the credit bureaus (BKR) and monitor for unexpected credit applications.
- Be extra suspicious of calls or messages claiming to be from your bank, government, or Odido — criminals now have enough details to make these very convincing.
- Consider changing your Odido password and enabling two-factor authentication if you haven’t already.