ShinyHunters, a prominent extortion group, has started leaking information allegedly stolen from Odido, the largest Dutch telecom. The agitated attackers are threatening to leak two million records every day.

The attackers say they have leaked 2 million records, supposedly stolen from Odido, a major Dutch telecom that suffered a data breach earlier in February. According to ShinyHunters’ post on a dark web blog.

“Day 2 leak is here. After tomorrow (day 3), we will start publishing 2 million records per day. This is because of the recent Odidos' stance on not paying a ransom,” the attackers claim.

ShinyHunters are trying to up the ante for Odido, blaming the company for the data leak. While it is obvious that ShinyHunters is attempting to create a narrative where the victim company is to blame for cybercrooks leaking their data, extortion groups often act like this to coax companies into paying ransom.

We have reached out to Odido for comment and will update this article once we receive a reply.

Meanwhile, the Cybernews research team investigated the data that the attackers attached to their dark web post. Our team found that attackers indeed leaked 2 million records. However, not every line in the dataset represents active data.

“Some records are duplicating or referencing inactive users. These records only have a part of the name, with other fields where personal information should be listed left empty,” our researchers noticed.

Other lines of records did include full names and addresses, with some having phone numbers and email addresses. While having personally identifiable information (PII) exposed increases the risk of social engineering and fraud, so far, the leaked data is not particularly dangerous.

Earlier this week, ShinyHunters posted Odido on its dark web blog, claiming the gang will start to leak customer data if the company refuses to pay the ransom.

In early February, Odido announced that the company had suffered a data breach of its customer relationship management system, with unnamed attackers accessing personal data of over 6 million Odido customers.

Odido's client base hovers around 7 million, meaning the attack exposed nearly all of the company’s customers.

While the February Odido data breach does not have a clearly named culprit, there’s a high chance that ShinyHunters was behind the attack.

The gang has been dominating headlines following several high-profile attacks on well-known companies.

ShinyHunters has recently claimed attacks against Bumble, dating apps Hinge, Match, and OkCupid, as well as two heavyweight US investment advisory firms – Mercer Advisors and Beacon Pointe Advisors.

---

Unlock more exclusive Cybernews content on YouTube.