Telecom provider Odido has refused to pay a ransom demand after hackers stole millions of customer records and began publishing the data online.
Quick Summary – TLDR:
- 6 million customer accounts were compromised in the Odido breach.
- Hackers from ShinyHunters began leaking data after ransom refusal.
- Sensitive data includes bank accounts, passport numbers, and birth dates.
- Dutch authorities have launched a criminal investigation.
What Happened?
Dutch telecom company Odido confirmed that cybercriminal group ShinyHunters has started publishing stolen customer information on the dark web after the company refused to pay a ransom. The breach, which occurred between February 7 and 8, 2026, affected more than 6 million accounts.
The attackers had threatened to release one million lines of customer data per day if their demands were not met. Following Odido’s decision not to negotiate, large datasets were published in two separate dumps.
Massive Data Leak Unfolds
The breach is now considered one of the largest ever carried out in the Netherlands. According to national broadcaster NOS, the hacking group shared samples of the stolen data as proof of access.
The leaked information is extensive and highly sensitive. It includes:
- Full names and home addresses
- Email addresses and phone numbers
- Dates of birth
- Bank account numbers
- Passport and driver’s license details
- Customer service notes and payment agreement records
Data tracking site Have I Been Pwned reported that the first public dump contained one million records, exposing 317,000 unique email addresses. A second release followed the next day with another one million records, affecting 371,000 unique email addresses.
Initially, ShinyHunters claimed it had accessed 21 million records, a figure significantly higher than Odido’s confirmed estimate of approximately 6.2 million affected accounts.
Company Refuses to Pay Ransom
Odido made clear it would not give in to blackmail. In a public statement, the company said it decided not to negotiate with the criminals after consulting cybersecurity experts and government authorities.
Law enforcement officials supported that decision. Stan Duijf of the national police said, “Our advice to victims of ransomware is not to pay,” adding that ransom payments can fund future attacks and offer no guarantee that stolen data will be deleted.
The Public Prosecutor’s Office has launched a criminal investigation into the attack. Authorities are working to determine how the hackers gained access and whether additional data could surface.
Rising Fraud Concerns
The fallout is already visible. Reports of identity fraud have more than doubled in the past week. The Central Identity Fraud Reporting Point confirmed 590 cases linked to the Odido breach.
Security experts warn that the exposure of government identification numbers and banking information significantly increases the risk of identity theft and financial fraud. Unlike passwords, data such as birth dates and passport numbers cannot easily be changed.
Odido has offered affected customers a two year subscription to F-Secure security software as compensation. However, experts argue that security software cannot fully protect customers from misuse of leaked personal information.
Customers are being urged to:
- Monitor bank accounts for suspicious transactions.
- Watch for phishing attempts that reference personal details.
- Use password managers to create strong and unique passwords.
- Stay alert for identity fraud alerts.
A Pattern from ShinyHunters
ShinyHunters has been linked to previous high profile data theft cases involving Ticketmaster and Pornhub. The group is known for large scale breaches followed by extortion attempts and public leaks when ransom demands are rejected.
The scale of the Odido breach highlights growing concerns about cybersecurity resilience in the telecom sector, where vast amounts of personal data are stored.
SQ Magazine Takeaway
I believe this data breach is a wake up call for the entire telecom industry. When millions of passport numbers and bank details are exposed, the damage goes far beyond a single company. Refusing to pay ransom is the right long term decision, but customers are left carrying the immediate risk. Companies handling sensitive data must treat cybersecurity as a core responsibility, not just an IT issue.
This incident shows how quickly trust can be shaken. If you are an Odido customer, staying alert right now is not optional. It is necessary.
