Email addresses stolen in February’s Odido hack are still being used to bombard victims with scam emails. Researchers count dozens of separate phishing campaigns since the data went public.
When 6.2 million Odido accounts were stolen back in February, the obvious worry was what criminals would eventually do with all that personal data.
Five months on, we have a real answer, and it comes from two people who watched it happen to their own inboxes.
From ethical hackers to full-on investigators
Two ethical hackers at security firm Hackify, whose own details were in the stolen dataset, decided to track exactly what happened next.
Both already had a personal habit of giving every company a unique email address, so if junk mail later turns up at one of those addresses, they can tell instantly which company leaked their details.
One of them had handed Odido an address used for nothing else, while the other had done the same with Tele2, the brand Odido absorbed back in 2023.
Both addresses ended up in the stolen dataset, so every scam email that landed in their inboxes could be traced directly to this one breach.
Over the 150 days after the full data went public, the two addresses collected a whopping 61 phishing emails.
Researchers found the pattern bizarre
Curiously, however, the emails didn’t arrive in a steady rush.
The first phishing email showed up on March 12, just 11 days after the leaked data hit the dark web, and the volume climbed to a peak in June. Then it simply stopped.
After early July, nothing else came in, prompting the researchers to wonder, only half-jokingly, whether the criminals had gone on holiday.
Speaking to NU.nl, ethical hacker Rick Verdoes estimated that the 61 emails belonged to around thirty separate phishing campaigns.
Most of the emails were the familiar rogues’ gallery of Dutch phishing, such as messages from banks, PostNL, and the KVK (the Dutch Chamber of Commerce).
One imitated Odido itself and, oddly, only contacted the Tele2 address. And, while it pulled its images straight from Odido’s real servers, the message was actually sent from a hacked business account in Turkey.
Another posed as ABN AMRO and greeted the victim by their actual name, the only email in five months to do so.
Things could get much worse
The stolen dataset held far more than email addresses: names, home addresses, dates of birth, and, according to Hackify, roughly 275,000 bank account numbers.
However, the scammers barely touched any of it. Verdoes suspects the email addresses were skimmed off into a simple, easy-to-share list, while the fuller database sits untouched because stitching it together takes real effort.
“A list of millions of email addresses is only a relatively small file and easy to use,” Verdoes tells NU.nl. “The full database is much larger and contains unstructured data. It takes more time and knowledge to automatically link that data together.”
In other words, if you’ve been involved in the data breach and haven’t received many phishing emails yet, you may not be in the clear.
That being said, there’s some recourse: as Dutch police have found signs that Dutch nationals were involved in the original hack, affected customers can now join a €500 class action claim.
Want to make sure DutchReview pops up on your news feed more often? Just add us as a preferred news provider, and we’ll handle the rest.
