Warning: Data of former Ooredoo customers stolen in a large-scale breach
A major cyberattack on Dutch telecom provider Odido has exposed personal data belonging to millions of current and former customers. Reports suggest that some of the stolen information should have been deleted years ago under privacy law.
According to Financieele Dagblad, Odido kept personal data of former customers for much longer than legally permitted. Although the company claims it stores such data for only a few years, some affected individuals had ended their contracts more than ten years ago.
The hack, which occurred last week, may have compromised data from up to 6.2 million customers. Odido confirmed that both current and former clients were affected and said it is still investigating how the attackers gained access to such a large volume of information.
IT lawyer جوب فيلينغر warned that the situation is especially serious if data that should have been deleted was still being stored. He said this indicates weak internal data management and a possible violation of privacy laws, adding that a breach alone is bad, but keeping outdated records makes the case far worse.
Odido told the newspaper it needs more time to understand why information about former clients was still in its systems. The breach also involved customers of its subsidiary Ben. The company was formed in 2023 after T-Mobile Nederland and Tele2 Mobiel merged under the Odido name.
The Dutch privacy regulator, AP, said it is closely monitoring the situation. The watchdog is expected to assess whether Odido violated data protection rules and whether further action will be taken against the telecom provider.