Odido data breach: 150 days and 61 phishing emails later

In the cyberattack on Odido in February 2026, the data of 6.2 million accounts fell into the hands of criminals, according to experts one of the largest data breaches ever in the Netherlands. Since 1 March the full haul has been on the dark web, available to anyone who knows where to look.

Two of our colleagues were unfortunately in that dataset. Both use a unique email address per service, and these two aliases were only ever given out to Odido and to the acquired brand Tele2. Every phishing email that has arrived on them since is therefore traceable to this one breach, which gave us insights that most victims never get.

In the 150 days after the stolen data was published, 61 phishing emails came in, 32 on the Odido address and 29 on the Tele2 address. In this blog post we describe our approach and the figures it produced.

The Odido data breach

On 5 and 6 February 2026, Odido was the target of a cyberattack by the criminal group ShinyHunters, which got into the customer contact system through phishing of employees and a phone call on behalf of the IT department. Odido refused to pay ransom, after which the group published a first part and, on 1 March, the full dataset followed.

Stolen were full name, address and place of residence, phone number, customer number, email address, bank account number, date of birth, and the numbers and expiry dates of identity documents such as passport or driving licence, according to the NOS. The hacked system also held data of customers of Ben, which is part of Odido. That does not apply to customers of Simpel.

Unique email aliases

Both colleagues use a catch-all domain. For every organisation where they create an account, they use a new address following the same pattern: <organisation>@<own mail domain>. So at Odido they left odido@<own mail domain>, and that address was never entered anywhere else.

Two weeks after the dataset was published, this Ledger phishing email arrived, at three o’clock in the morning, addressed to odido@.

The unique address of the second colleague was left with Tele2, so tele2@<own mail domain>. On 5 September 2023, T-Mobile, Tele2 and Tweak continued under the name Odido. That address too was stolen and published by ShinyHunters after Odido refused to pay.

The timeline

Both addresses received roughly the same amount of mail, 32 on the Odido alias and 29 on the Tele2 one. Per week they are close too: in 11 of the 16 weeks in which something arrived, the difference was at most one message. There are outliers. In the week of 22 June the Odido address got seven and the Tele2 address just one, while in early April the Tele2 address got four and the other none.

What stands out most is how quickly it began. The first message arrived on 12 March, eleven days after the dataset was published, and three days later there was one on the second address too.

We also noticed that after 3 July no phishing emails came in at all. Perhaps the cybercriminals went on holiday too?

Which data did they use?

The hack involved much more than email addresses. RTL Nieuws analysed the published dataset and found 275,000 IBANs in it, alongside customer service notes revealing who had received a payment reminder and who was under financial guardianship.

We had expected the phishing emails to use this kind of information to appear more legitimate. That barely happened. No address, no IBAN, no phone number. Ten messages put the email address as the salutation at the top, literally “Dear odido@…”. The rest kept it to “Dear Sir/Madam” or started without a salutation.

One message went further. On 1 July an ABN AMRO imitation came in that opened with the salutation, the initial and the surname of the victim.

Phishing emails by category

In the end we were also curious what kind of phishing emails we received. So we clustered all the messages into categories. Mostly the usual suspects show up, such as Chamber of Commerce (KVK) phishing, banks and parcel couriers.

One category stood out: phishing that posed as Odido. Remarkably, it only came in on the Tele2 alias.

The images in this phishing email are pulled directly from Odido’s real servers. The message itself came from a business email address in Turkey. Our assumption is that this account was compromised and then used to send phishing.

The quality and subject of the messages varied widely. The Dutch was fine in most cases. At the same time we saw the familiar traces of AI in the text and layout, such as em dashes and text blocks with a coloured accent bar on the left. In the message below about a free gift card the formatting is clearest.

Overlap between mail aliases

Finally, we looked at how much overlap there was between the two mail aliases. Of the 61 phishing emails, 28 came in on both addresses, fourteen per alias. The other 33 hit just one of the two: eighteen only the Odido alias, fifteen only the Tele2 alias. That suggests the stolen addresses circulate in different selections, rather than being used as one fixed mailing list.

Conclusion

One hundred and fifty days after publication the counter stands at 61 phishing emails, and the pattern is clearer than we expected beforehand. It only started once the dataset became public, it rose to a peak in June, and then it went quiet.

The most striking thing is what the senders did not use. Although the dataset contained far more personal data, in almost all messages they processed only the email address. In five months only a single phishing email addressed a recipient by name. That is reassuring, but possibly only temporary: names, addresses and 275,000 IBANs are still available. As soon as criminals start combining that data, the messages can become far more personal and convincing, as with spear phishing.

What you can do yourself

Use a unique email address for each service, so you can see more quickly where a leak comes from. When you get warnings, blocks or prizes, do not click links in the email, but open the official website or app yourself. Always check the real sender address and use a password manager and passkeys where possible.

If you do not have your own mail domain, many providers let you use a plus sign:

[email protected]
[email protected]

Everything after the plus is ignored on delivery, so the mail simply arrives in your existing inbox.

Have you been a customer of Odido, Ben or Tele2? Then check via Checkjehack whether your data is in the dataset.