383/69 Tuesday, July 14, 2026
Dutch police have disclosed progress in the investigation into the cyberattack against Odido, one of the country’s major telecommunications providers, which occurred in February 2026. Investigators found indications that the perpetrators may be Dutch nationals or may have connections inside the Netherlands. The incident resulted in the theft of data belonging to more than 6 million customers, which was later published. Odido is one of the largest mobile network operators in the Netherlands, serving approximately 8 million mobile customers and around 1 million fixed broadband customers under several brands, including Odido, Ben, and Simpel.
Previously, the ShinyHunters cybercrime group claimed to have breached Odido’s systems and accessed data from approximately 6.2 million customer accounts. Odido confirmed that the incident affected personal data from its customer service contact system, including names, addresses, phone numbers, email addresses, bank account details, dates of birth, and passport or identity card numbers. However, the company stated that My Odido account passwords, call logs, location data, invoice details, and copies of identity documents were not affected. The company quickly blocked unauthorized access and hired external cybersecurity experts to support incident response and strengthen additional protective measures.
The investigation is being conducted by the High Tech Crime Team of the Dutch investigative authorities. In the early stage of the investigation, officers were able to shut down several servers used by the attackers to publish the stolen data. In addition, police found an important lead from a phone call made to Odido’s customer service. The caller, who spoke Dutch, impersonated an Odido IT employee before the company was later targeted through phishing and suffered data theft. Police are now asking the public to provide any relevant information and believe that people close to the suspects or individuals within cybercrime circles may know who was involved in the incident. Authorities also warned that attacks of this nature are becoming more frequent and that organizations should prioritize strengthening their cybersecurity measures.