Dutch Authorities Arrest Suspected ShinyHunters Affiliate in Odido Cyberattack Dutch police have arrested a 23-year-old man in connection with the February cyberattack on telecom provider Odido, an incident claimed by the hacking group ShinyHunters. Multiple sources, including cybersecurity journalist Brian Krebs, identify the suspect as Pepijn van der Stap, a convicted hacker and former security researcher. Van der Stap was taken into custody on or around September 16 and remains in police custody for questioning. The arrest follows a months-long investigation by the Dutch National Police and Public Prosecution Service into the breach, which exposed data belonging to over six million Odido customers after the company refused to pay a ransom. Investigators allege the attack began with a social engineering call to Odido’s customer service. A Dutch-speaking man, posing as an IT employee, convinced a staff member to enter credentials on a fake login page and provide a multi-factor authentication code, granting access to internal systems. Police released a recording of the call earlier this month, though they have not publicly confirmed whether Van der Stap is the speaker. ShinyHunters initially leaked two million Odido records in February, claiming to have stolen far more data. The group later stated it would provide the arrested individual with legal and financial support, though it has since denied any association with Van der Stap, calling the arrest a publicity stunt by Dutch authorities. Van der Stap has a history of cybercrime, including a 2023 conviction for hacking, data theft, and extortion, which prosecutors said generated €1.5–2.7 million. Operating under the alias "Umbreon" (a Pokémon character), he sold stolen databases on forums like RaidForums and Breached. Despite his criminal past, he also worked as a software engineer at Hadrian, volunteered with the Dutch Institute for Vulnerability Disclosure (DIVD), and later served as Offensive Security Lead at Neo Security. His online presence includes claims of submitting over 100,000 responsible disclosure reports, though his recent arrest raises questions about his alleged shift away from cybercrime. In a September 9 interview with Krebs, Van der Stap stated he had left illicit activities behind but was still dealing with civil claims from his past offenses. The "Umbreon" alias has resurfaced in recent ShinyHunters activity, including an ASCII art depiction in the group’s defacement of the FBI Jobs portal this month. However, sources cited by Krebs suggest internal conflicts within the group, with another hacker known as "Rey" potentially using the imagery to implicate Van der Stap. Dutch authorities have not publicly linked him to the FBI breach. The investigation remains active, with police yet to disclose the evidence against Van der Stap or confirm his role in the Odido attack. ShinyHunters has dismissed the arrest as an attempt by Dutch authorities to regain credibility after the high-profile breach.

Odido Suffers Cyberattack, Customer Data Compromised in Breach Dutch telecommunications provider Odido disclosed a cyberattack on Thursday, confirming that customer data was compromised while maintaining that its services remained operational. The company, owned by private equity firms Apax Partners and Warburg Pincus, stated it swiftly contained the incident and reported the breach to the Authority for Personal Data. Odido clarified that sensitive information such as passwords, call records, and invoice data was not accessed in the attack. However, due to the scale of the breach, the company plans to notify affected customers within 48 hours, though the exact number of impacted individuals was not specified. The incident follows a separate cyberattack on the European Commission’s central mobile infrastructure reported on February 5, which potentially exposed staff names and mobile numbers. In response, the Commission emphasized its commitment to bolstering the EU’s cybersecurity resilience amid rising threats to critical services and institutions.

Odido Data Breach Exposes Millions of Dutch Customers’ Personal Information One of the Netherlands’ largest telecom providers, Odido formerly T-Mobile Netherlands has confirmed a major data breach affecting millions of its customers. The incident, first reported by TechCrunch, ranks among the most significant cybersecurity failures in Europe’s telecom sector in recent years, raising concerns about data protection practices and regulatory compliance. ### Scope and Impact of the Breach Odido, which rebranded in 2023 after being acquired by private equity firms Apax Partners and Warburg Pincus, serves a substantial portion of the Dutch mobile market. While the full extent of the breach is still under investigation, the company has acknowledged that customer names, contact details, and other personally identifiable information (PII) were exposed. It remains unclear whether more sensitive data such as financial records, identification numbers, or call logs was also compromised. Under the EU’s General Data Protection Regulation (GDPR), Odido reported the incident to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), which is monitoring the company’s response. GDPR mandates breach notifications within 72 hours and imposes fines of up to 4% of global annual revenue for non-compliance. Given the regulator’s history of strict enforcement including a €290 million fine against Uber in 2024 Odido could face significant penalties if negligence is found. ### Response and Industry Fallout Odido has engaged external cybersecurity experts to investigate the breach and has advised affected customers to remain vigilant against phishing and social engineering attacks. However, security analysts warn that the company’s response must extend beyond standard crisis communications to rebuild trust, particularly given telecom providers’ access to sensitive data like location tracking, call metadata, and browsing histories. The breach is not Odido’s first. In 2022, while still operating as T-Mobile Netherlands, the company suffered a similar incident, part of a broader pattern of cyberattacks targeting T-Mobile’s global operations. The recurrence under a new brand raises questions about whether security infrastructure was adequately overhauled during the transition. ### Regulatory and Financial Pressures The incident comes as the EU’s Network and Information Security Directive (NIS2), which took effect in October 2024, imposes stricter cybersecurity requirements on telecom operators. Companies must now implement comprehensive risk management measures and report significant incidents to authorities. Odido’s compliance with NIS2 at the time of the breach will likely be a focal point of any regulatory inquiry. Critics also highlight private equity ownership as a potential factor in the breach. With firms like Apax and Warburg Pincus prioritizing cost optimization, cybersecurity budgets may have been scaled back amid financial pressures from 5G rollouts and price competition. Industry observers question whether security investments kept pace with network expansion and marketing efforts. ### Broader Implications for Europe’s Telecom Sector The breach underscores the growing cybersecurity risks facing Europe’s telecom industry, where networks underpin everything from personal communications to critical infrastructure. As regulators and consumers demand higher standards, companies failing to meet expectations risk financial penalties and reputational damage. For Odido, the crisis presents a critical test: whether a rebranded and restructured operator can address deep-rooted security vulnerabilities or if past weaknesses persist despite corporate changes. With millions of Dutch customers’ data now in unknown hands, the fallout will be closely watched.