Back to Knowledge Vault

Major Telco Breach: 6.2 Million Users Exposed

Dutch telecommunications company Odido has confirmed a cyberattack exposing personal data of 6.2 million customers, including names, dates of birth, and contact details from a customer contact system.

What Happened

Dutch telecommunications company Odido, one of the Netherlands' largest mobile operators, has confirmed suffering a significant cyberattack that compromised personal data belonging to approximately 6.2 million customers. In a notice published on its website, the company said it "deeply regrets" the situation and is "fully committed" to limiting its impact.

What Data Was Exposed

According to Odido's investigation, the breach originated from a customer contact system. The compromised data includes personal information such as names, dates of birth, email addresses, and phone numbers. The company has confirmed that no passwords, call records, or billing information were involved in the incident.

Scale of the Breach

With 6.2 million users affected, this ranks among the larger European telecommunications breaches in recent memory. Odido is one of the major mobile network operators in the Netherlands, making the scale of this breach particularly concerning for Dutch consumers and the broader European data protection landscape.

Why This Matters

Even without passwords or financial data, the exposed information creates serious risks for affected individuals. Names combined with dates of birth, email addresses, and phone numbers provide everything needed for targeted phishing campaigns, identity fraud, and social engineering attacks. Criminals can use this data to craft highly convincing scam messages that reference real personal details.

The Bigger Picture

This breach is a stark reminder that cloud-connected systems remain a persistent target for attackers. Customer contact platforms, CRM tools, and support databases often hold vast quantities of personal data, yet they rarely receive the same security scrutiny as core billing or authentication systems. The result is a growing pattern of breaches where millions of records are exposed through what organisations consider secondary systems.

How Firevault Addresses This Risk

Firevault's Layer 1 physical air gap storage removes sensitive data from internet-connected infrastructure entirely. By storing critical personal records offline in secure, geographically distributed bunkers, organisations eliminate the attack surface that made this breach possible. Data that is not online simply cannot be reached by remote attackers, no matter how sophisticated their methods.

For telecommunications companies and any organisation handling millions of customer records, the question is no longer whether a breach will happen, but when. Physical isolation through air gap technology offers the only architecture where "when" becomes irrelevant.

Share this article