Telecom giant Odido under cyberattack: experts highlight high-stakes dilemma

Telecom provider Odido has only two choices following a threat from the cybercriminal group ShinyHunters to publish stolen data: pay the ransom or refuse, according to Rolf van Wegberg, an associate professor at TU Delft who studies how cybercriminals profit.

Odido recently announced a data breach impacting personal details from 6.2 million accounts, such as bank account numbers, phone numbers, and ID information. According to the company’s website, “Our investigation shows that the incident involves personal data from a customer contact system used by Odido. No passwords, call records, or billing information were involved.”

ShinyHunters is responsible for the hack on Odido, RTL Nieuws reported. The telecom company is being pressured on the dark web to pay a ransom. Odido has so far declined to comment on its next steps or whether it intends to pay.

Van Wegberg believes that ShinyHunters’ public threat comes after private negotiations. “In cases like this, the parties usually first negotiate privately. If that fails, the next step is to apply public pressure,” he explained.

The cybercriminal group has escalated the situation, demanding more than 1 million euros and setting a payment deadline for Thursday morning, according to RTL Nieuws.

Van Wegberg believes Odido is now carefully considering its options, likely together with cybercrime specialists. “It’s an extremely complex decision, morally very difficult, and the company also bears responsibility toward its customers.”

Should Odido choose to pay, the chances of the data being released anyway are not very high, according to Van Wegberg. “These groups usually stick to their word; their credibility in future attacks depends on it. There is a strong financial incentive for them to follow through on their promises,” he said.

If Odido opts not to pay, ShinyHunters may intensify its tactics, Van Wegberg said, citing his research. “They could release a portion of the data or raise the ransom amount.”

ShinyHunters could also follow through on its threat and release the data on the dark web. The impact would be serious, Van Wegberg warned. “The leak contains not just names and email addresses, but also passport and bank account numbers, something rarely seen in a single breach. That makes it relatively easy for criminals to craft convincing phishing emails. If the data are published on the dark web, they could be exploited by many different criminals.”

While it remains uncertain if Odido customers will be compensated for the major data breach that occurred a week and a half ago, the company is offering them a free two-year security package. The package, the telecom firm says, includes extra protection against viruses.

Hundreds of people have now reached out to the Identity Fraud Reporting Center. While most are expressing concern, a few say their leaked information has already been exploited. The center will look into whether these reports are valid.