Odido Reports Breach Affecting 6.2 Million Customers as ShinyHunters Claims 21 Million Records
Summary
Odido disclosed unauthorized access to its customer contact system and says 6.2 million customers were affected. ShinyHunters claims 21 million records and additional data; Odido disputes claims about passwords and other sensitive information.
Key points
- Odido says attackers accessed its customer contact system on February 7; the company disclosed the breach on February 12 and reported that about 6.2 million customers were affected.
- Exposed data may include names, addresses, phone numbers, email addresses, IBANs, dates of birth and some identification details.
- ShinyHunters claims it stole nearly 21 million records and listed Odido on its leak site; the claim does not independently establish the number or contents of records stolen.
- ShinyHunters also claimed the data included internal corporate information and plaintext passwords. Odido denied that passwords, call details, social security numbers or billing data were involved.
- Odido says it reported the incident to the Dutch Data Protection Authority, blocked the attackers’ access and hired external cybersecurity experts.
- The article separately describes ShinyHunters’ use of vishing and OAuth device-code abuse to hijack SSO accounts and access connected enterprise services; it does not establish that these methods were used against Odido.
Article Details
- Victim Organization
- Odido
- Incident Type
- Unauthorized access to Odido’s customer contact system and download of customer data; ShinyHunters claims responsibility, but Odido has not attributed the breach to a threat group.
- Data Types Exposed
- Names
- Addresses and city of residence
- Mobile phone numbers
- Customer numbers
- Email addresses
- IBANs
- Dates of birth
- Some passport or driver’s license numbers and validity details
- Affected Records
- Odido said 6.2 million customers were affected. ShinyHunters separately claimed to have stolen nearly 21 million records; that larger figure is not independently confirmed in the article.
- Operational Impact
- Odido blocked the attackers’ access, reported the breach to the Dutch Data Protection Authority, and engaged external cybersecurity responders. No service disruption is reported.
- Ransom Or Extortion
- ShinyHunters listed Odido on its leak site and threatened to leak data and cause further problems, urging the company to return to its chat. Odido had not confirmed whether a ransom was demanded; no payment is reported.
- Claim Status
- confirmed
MITRE ATT&CK
T1078 · Valid AccountsThe article describes ShinyHunters hijacking victims’ SSO accounts in other attacks; it does not establish that this technique was used to access Odido.T1528 · Steal Application Access TokenThe article says ShinyHunters has abused the OAuth device authorization flow to obtain authentication tokens in other attacks; it does not establish use against Odido.T1566.004 · Spearphishing VoiceThe article says ShinyHunters has used voice phishing against employees at other victims; it does not establish that vishing was used in the Odido breach.