Odido data breach (February 2026): what the Dutch telecom confirmed
In February 2026 Odido, one of the Netherlands’ largest telecom operators, disclosed that attackers had viewed data on millions of customers after phishing its customer-service staff.
Short answer
Was Odido hacked?
Yes. Odido said attackers viewed customer data over the weekend of 7–8 February 2026, including names, addresses, bank account numbers and dates of birth, for up to 6.2 million accounts; it says passwords and call records were not taken.
NOS reported the attackers phished customer-service staff while posing as the IT department. Odido said it would not pay a ransom.
Timeline at a glance
7–8 Feb 2026Attackers view data of up to 6.2M customer accounts. (NOS)Confirmed
Feb 2026Entry via phishing of customer-service staff. (NOS)Reported
Last updated October 31, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Odido’s security posture at the time
What Odido publicly said about its security certifications and controls, how big it is, and how its shares moved, each tied to a source. A certificate covers a stated scope at a point in time; it is not a guarantee about every system. Reviewed 31 October 2026. Compare all 2026 breaches.
Security certifications publicly held
No public certification found.
No ISO 27001 or SOC 2 found. Kiwa’s certificate register lists an ISO 9001:2015 (quality management) certificate for Odido Netherlands B.V., which is not a security standard and is not counted.
Size
Private; revenue not verified for this page
Listing: Private
Share price around the disclosure
Not listed.
Odido incident timeline, in detail
Confirmed = acknowledged by Odido, a regulator filing or a court. Reported = credible reporting Odido has not fully confirmed. Unverified claim = an attacker or leak-site claim.
12 Feb 2026ConfirmedIdentity / help desk
Phished customer-service logins expose millions of Odido customers
What happened. Odido said attackers viewed customer data over the weekend of 7–8 February 2026, including names, addresses, bank account numbers and dates of birth; it says passwords and call records were not taken. NOS reported the attackers phished customer-service staff while posing as the IT department.
Impact. Names, addresses, bank account numbers and dates of birth exposed, per Odido. People or records affected: Up to 6.2 million customer accounts, per Odido (as reported by NOS). Attackers claimed higher numbers.
The attackers claimed more customers were affected than Odido’s figure.
The pattern across the record
Certified, and still breached?
We found no SOC 2 or ISO 27001 certification published by Odido. That does not prove it had none; it means none was public.
The way in was a person, not a server
Like most of 2026’s large data thefts, this one is described as starting with social engineering: a phished or voice-phished login, often to single sign-on, then bulk export from a SaaS application. Certification audits test that identity controls exist and operate; they do not promise that no employee or contractor will ever be talked out of a login.
What it means for Odido Odido and Ben customers — and what to do
What Odido’s customers, partners and security teams can do now, based only on what has been disclosed.
1.Assume phishing follows the breach
Exposed contact details are used for convincing follow-up phishing. Warn staff and customers that genuine notices will not ask for passwords or payment.
2.Check your own help-desk and SSO flows
Require callback verification and phishing-resistant MFA for account and MFA resets; voice requests alone should never reset a login.
3.Ask the vendor what was exported, in writing
Ask which applications and fields were reached, the date range, and whether your organisation’s records were included.
Yes. Odido said attackers viewed customer data over the weekend of 7–8 February 2026, including names, addresses, bank account numbers and dates of birth, for up to 6.2 million accounts; it says passwords and call records were not taken.
Did Odido have SOC 2 or ISO 27001 certification?+
We found no SOC 2 or ISO 27001 certification published by Odido. That does not prove it had none; it means none was public.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Odido. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout