In February 2026, Dutch telecom Odido (formerly T-Mobile Netherlands) disclosed a breach affecting roughly 6.2 million customers across Odido and its Ben brand. Attackers linked to ShinyHunters used social engineering — phishing and impersonating IT staff to bypass MFA — to reach a customer contact system, taking names, addresses, bank account numbers, phone and email, and ID document numbers (passport/driver's licence); passwords, call logs and billing were not affected. We cover the extortion attempt, that Odido reportedly learned of the theft when the attackers made contact, and the regulatory and legal fallout.

Concerned about social engineering and account takeover? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: BleepingComputer; SecurityWeek.