ShinyHunters' Odido (NL telecom) breach: Dutch police voice analysis points to Dutch-national involvement; same vishing-into-spoofed-portal playbook, now against an EU telco
Dutch National Police (Team High Tech Crime) announced on 9 July that its investigation into the February 2026 breach of Dutch telecom operator Odido — and its Ben brand — has produced strong indications of Dutch-national involvement, based on forensic voice analysis of a call recorded at the time of the intrusion; police assess the caller as very likely a genuine human speaker (while not fully ruling out synthetic voice) and are publicly appealing for the caller to come forward before the recording is released (Politie, 2026-07-09; NOS, 2026-07-09).
This extends the ShinyHunters vishing-to-spoofed-portal playbook (registry: actor:shinyhunters) already covered in this store to a new victim class — an EU telecommunications operator. The mechanism, confirmed on-record by Odido CEO Tisha van Lammeren, is the same one documented previously: a caller impersonating Odido IT-department staff (T1684.001) used a voice-phishing pretext (T1566.004) to persuade a customer-service employee to log into a spoofed copy of the corporate work environment, harvesting that employee's real credentials (T1078) for the customer-contact system (NOS, 2026-05-12). Odido blocked the account within an hour of noticing the intrusion (NOS, 2026-05-12), but the operators had already bulk-exported 6.2 million customer records (name, address, contact details, customer number, bank account number, date of birth, and passport/driver's-licence numbers) (NOS, 2026-02-12) — the CEO's Dutch quote via NOS: "De hacker wist deze medewerker over te halen om in te loggen op een valse versie van de werkomgeving. Zo heeft hij de inloggegevens van die persoon gestolen" ("the hacker persuaded this employee to log into a fake version of the work environment, and so stole that person's login credentials") (T1213). The Dutch Data Protection Authority has two open investigations — into the adequacy of Odido's customer-system security and into whether it retained former-customer data longer than permitted.
In het onderzoek heeft de politie sterke aanwijzingen gevonden dat Nederlandse criminelen betrokken zijn bij de Odido-hack.
De hacker wist deze medewerker over te halen om in te loggen op een valse versie van de werkomgeving. Zo heeft hij de inloggegevens van die persoon gestolen.
Defender actions
- Reinforce helpdesk/customer-service verification: require out-of-band callback confirmation before any staff member authenticates in response to an inbound call claiming to be internal IT — the control that would have stopped both the Odido and the earlier tracked ShinyHunters vishing intrusions.
- Alert on a single account performing a bulk export from a customer-contact or CRM repository shortly after an interactive sign-in from an unusual location; Odido's operators bulk-downloaded 6.2M records before the account was blocked within the hour.
ATT&CK mapping
4 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1566.004Phishing: Spearphishing Voice
Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient.
Persistence TA0003
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Privilege Escalation TA0004
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Stealth TA0005
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1684.001Social Engineering: Impersonation
Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims.
Collection TA0009
T1213Data from Information Repositories
Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.