ShinyHunters, a prominent extortion group, has started leaking information allegedly stolen from Odido, the largest Dutch telecom. The agitated attackers are threatening to leak two million records every day.

Key takeaways:

ShinyHunters staretd leaking Odido records to force the Dutch telecom into paying ransom.
Researchers say that the leaked dataset contains full names, physical addresses, phone numbers, and email addresses.
The data dump includes duplicate entries and inactive user profiles mixed with genuine personal information.
This escalation follows a February breach where attackers accessed the personal data of over 6 million Odido customers.

Key Takeaways by nexos.ai, reviewed by Cybernews staff.

The attackers say they have leaked 2 million records, supposedly stolen from Odido, a major Dutch telecom that suffered a data breach earlier in February. According to ShinyHunters’ post on a dark web blog.

“Day 2 leak is here. After tomorrow (day 3), we will start publishing 2 million records per day. This is because of the recent Odidos' stance on not paying a ransom,” the attackers claim.

ShinyHunters are trying to up the ante for Odido, blaming the company for the data leak. While it is obvious that ShinyHunters is attempting to create a narrative where the victim company is to blame for cybercrooks leaking their data, extortion groups often act like this to coax companies into paying ransom.

We have reached out to Odido for comment and will update this article once we receive a reply.

odido dark web post — Odido post on ShinyHunters dark web blog. Image by Cybernews.

Meanwhile, the Cybernews research team investigated the data that the attackers attached to their dark web post. Our team found that attackers indeed leaked 2 million records. However, not every line in the dataset represents active data.

“Some records are duplicating or referencing inactive users. These records only have a part of the name, with other fields where personal information should be listed left empty,” our researchers noticed.

Other lines of records did include full names and addresses, with some having phone numbers and email addresses. While having personally identifiable information (PII) exposed increases the risk of social engineering and fraud, so far, the leaked data is not particularly dangerous.

Odido customer data leak sample — Sample of the leaked data. Image by Cybernews.

Earlier this week, ShinyHunters posted Odido on its dark web blog, claiming the gang will start to leak customer data if the company refuses to pay the ransom.

In early February, Odido announced that the company had suffered a data breach of its customer relationship management system, with unnamed attackers accessing personal data of over 6 million Odido customers.

Odido's client base hovers around 7 million, meaning the attack exposed nearly all of the company’s customers.

Check if your data has been leaked

Find out if your email, phone number or related personal information might have fallen into the wrong hands.

18,611,353,922

Breached accounts

36,030

Breached websites

While the February Odido data breach does not have a clearly named culprit, there’s a high chance that ShinyHunters was behind the attack.

The gang has been dominating headlines following several high-profile attacks on well-known companies.

ShinyHunters has recently claimed attacks against Bumble, dating apps Hinge, Match, and OkCupid, as well as two heavyweight US investment advisory firms – Mercer Advisors and Beacon Pointe Advisors.

Don't miss our latest stories on Google News. Add us as your Preferred Source on Google

Add us as your Preferred Source on Google.

Unlock more exclusive Cybernews content on YouTube.

Odido hackers talk big game, leak emails and phone numbers

Check if your data has been leaked