Odido Discovered Data Breach Only After Hackers Reported It

Telecom provider Odido only discovered two days after hackers had compromised customer data, after the hacking group ShinyHunters alerted the company themselves. Two days after the hack, Odido's internal conclusion was still that no data had been stolen, a senior executive from the company stated.

In early February, Odido, which also includes the brand Ben, was hacked. After Odido refused to pay a ransom, ShinyHunters posted the data of over 6 million customers on the dark web. This was a 'dark day,' according to the executive. The company acknowledges that the communication surrounding the attack could have been better, which has led to customer dissatisfaction.

The company has now released more details about how the theft could occur. A hacker contacted an Odido customer service employee, posing as someone from the IT department. The employee was persuaded to log into a fake website, through which the hacker gained access to login credentials. Although the employee's account was blocked within an hour, the damage was already done. Two days later, it appeared that millions of customer records had been downloaded in that short period.

What does this mean for SME businesses?

This incident underscores how crucial cybersecurity is, also for SMEs. The method of hacking – social manipulation of employees – demonstrates that not only technical vulnerabilities pose a threat. Ensure your employees are trained in recognizing phishing and social engineering. Additionally, always verify the identity of individuals requesting access to systems. Regular software updates and strong, unique passwords are also essential. Be prepared for incidents and ensure rapid communication channels with your customers and employees should something go wrong. When in doubt, engage an IT expert.