Odido data breach: what happened and what to do

What happened

Odido, one of the largest mobile and broadband providers in the Netherlands, said attackers got into its customer contact system in early February 2026. Odido told customers that the attack happened on February 7 and 8, and that it reported the incident to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Mobile and internet service kept running.

The company put the number of affected customers at about 6.2 million. It also said customers of its budget brand Ben were included. After an extortion attempt, the stolen records were published in four separate releases over consecutive days. Have I Been Pwned (HIBP) added the breach on February 26, 2026, and counts 6,077,025 unique email addresses in the published data.

Odido has set up a security page with an FAQ at odido.nl/veiligheid, and says it contacts affected customers directly.

What was exposed

HIBP lists these types of data: names, physical addresses, phone numbers, email addresses, dates of birth, genders, bank account numbers, customer service records, passport numbers, driver's license numbers and European national ID numbers. Coverage of Odido's own notice says the company did not see passwords, call logs, location data, invoice details or scans of identity documents in the stolen data.

That mix matters more than most breaches. A name, address, phone number and date of birth together are enough to make a scam call or letter sound like it comes from your provider. A bank account number (IBAN) lets a criminal look credible when they pretend to be your bank or ask you to "confirm a payment". Identity document numbers raise the risk of someone trying to open accounts or contracts in your name.

What criminals can do with it

Expect targeted phishing by email, text and phone. Messages may quote your real address or customer details, and some may claim to be from Odido, your bank or the police. Treat any unexpected contact that mentions this breach as suspect, even if it knows personal details. Those details came from the leak.

SIM swap fraud is the other concern with telecom data. A criminal who knows your name, number and date of birth may try to convince a carrier or shop to move your number to a new SIM, which can hand them your text-message login codes.

What Odido has said

Odido says it reported the breach to the regulator and is notifying affected customers. It has published an FAQ for customers and says passwords were not part of the data. If you are a current or former customer, check the notice on Odido's own site rather than links in messages, because scammers copy breach notices.

Was your data included

You can check your email address on Have I Been Pwned. Serus also runs a free scan that checks whether your email or phone number appears in this and other breaches. Serus can't remove data from a breach, but it keeps watching and alerts you when your details show up somewhere new.