Hackers publish remaining Odido customer data after ransom refusal

Hackers linked to the criminal group ShinyHunters published the remaining stolen customer information from the Dutch telecommunications provider Odido, national broadcaster NOS, and multiple reports said. The data release on March 1, 2026, followed earlier partial disclosures of records after Odido declined to pay a ransom demand. According to an analysis of the published files, the dataset covers information tied to about 6.5 million individuals and approximately 600,000 companies.

 

 

The released files include personal details such as dates of birth, phone numbers, and email addresses, as well as more than 5 million unique identification numbers linked to documents like passports and driver’s licences, NOS reported. The data also contains residence permits, including permits held by diplomats, and lists the email addresses of care providers or court-appointed administrators for roughly 71,000 people. Notes from customer service records, apparently relating to about 44,000 individuals, also form part of the dataset.

The September 2023 rebrand of the telecom operator saw Odido replace the T-Mobile and Tele2 brands in the Netherlands; as of January 2024, the company reported nearly 7 million customers. In February 2026, Odido disclosed that a cyberattack on its customer service systems had compromised personal data for millions of customers after attackers gained unauthorised access. Odido confirmed that it closed the unauthorised access, engaged external cybersecurity experts, and notified relevant authorities. The company said it was monitoring the incident and notifying affected users.

ShinyHunters initially began publishing portions of the stolen data in stages, threatening to release additional records each day until Odido met a ransom demand. Reports indicated that the group’s original ransom demand was about €1 million, later reduced to €500,000. Odido publicly stated that it would not pay ransom or engage in negotiations, saying that it would not allow itself to be blackmailed. Following that decision, the hackers made the remaining dataset publicly accessible immediately, though they said they were withholding some data they deemed “not relevant” for publication.

The breach and subsequent publication represent one of the largest private data leaks in Dutch history, involving detailed personally identifiable information on millions of current and former customers and a substantial number of companies. Past smaller releases of the stolen information contained a broader range of sensitive details, including banking account numbers and internal customer records, though the final set did not include all previously posted elements.

Authorities, including the Dutch Public Prosecution Service, have opened investigations into the cyberattack. National police and cybersecurity specialists have cautioned individuals affected by the leak to be alert to unusual communications or attempts by malicious actors to exploit the exposed data. Odido has advised customers to watch for suspicious emails, phone calls, or messages and has recommended vigilance in protecting personal information.

The incident highlights ongoing concerns about data security in telecommunications and the tactics used by criminal groups to extract and disseminate highly sensitive information, especially in cases involving extortion and public disclosure of stolen records.