Police believe a Dutch gang was behind a mass data breach at telecoms company Odido in which account details of six million customers were published online.
Hackers’ group ShinyHunters obtained the information by calling the company’s helpdesk posing as a member of the IT team and persuading a member of staff to log in to a fake website.
The gang used the login details to obtain Odido customers’ personal data and demand a ransom payment of €1 million. When the company refused to pay the money, the information, including addresses, telephone numbers and social security numbers (BSNs) was shared on the dark web.
Police said they had analysed the recording of the call, which was in Dutch, and believed that the voice was genuine.
They “strongly urged” the caller to come forward in the next few weeks, otherwise they would publish the recording.
“We can never 100% rule out it being AI,” police cybercrime specialist Stan Duijf told NOS. “But everything points to it being a Dutchman.”
Mass claim
The police investigation into Odido is expected to continue for several months.
The company is facing a mass claim by Consumers United in Court (CUIC), which says it ignored a warning from software firm Salesforce and hung on to its customers’ information for too long.
“The volume of stolen data shows that it was not properly protected,” CUIC said in a statement. “Odido was not sufficiently transparent and did not report the problem properly.”
