Odido data breach: 6.1M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2026-02-26
In February 2026, Dutch telco Odido was the victim of a data breach and subsequent extortion attempt. Shortly after, a total of 6M unique email addresses were published across four separate data releases over consecutive days. The exposed data includes names, physical addresses, phone numbers, bank account numbers, dates of birth, customer service notes and passport, driver’s licence and European national ID numbers. Odido has published a disclosure notice including an FAQ to support affected customers. Exposed data: bank account numbers, customer service records, dates of birth, driver's licenses, email addresses, genders, government issued ids, names, passport numbers, phone numbers, physical addresses. The breach dates from Feb 12, 2026; Have I Been Pwned loaded it on Feb 26, 2026.
What to do
- If you had a Odido account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
