Six months after a major hack of customer data in the Netherlands, some researchers have a clear picture of the actual impact on consumers. What can you expect when your data is stolen?
What happens when hackers break into a company and make off with data that includes your information? Thanks to the Odido breach in the Netherlands, combined with a bit of lucky coincidence, some researchers from Hackify have gained a clear picture of the actual impact.
Odido & Shinyhunters
A quick refresher: in early February, the Dutch telecom provider Odido fell victim to a successful cyberattack. The Shinyhunters criminals made off with gigabytes of customer data. Odido did not pay a ransom, after which the hackers kept their word and posted the data online.
The stolen dataset contained information from more than six million accounts, including email addresses, full names, address details, customer numbers, account numbers, and more. The dataset has been circulating on the internet since late February, where other digital criminals can put it to use.
Not a unique situation
Such news is not unique: hackers regularly succeed in stealing datasets containing customer information. Think of recent cases like Best Western, Nissan, Lastpass, Under Armour, or Rituals. Usually, it involves data as described above. Fortunately, truly critical data such as passwords or credit card details are well-encrypted today (mostly), keeping them inaccessible.
A leak like Odido’s is painful for the affected company, but the real victims are the customers whose data has been exposed. In such cases, the advice to consumers is always the same: be extra wary of phishing emails, as the stolen data is a goldmine for those wanting to send convincing phishing emails.
A (un)lucky coincidence
Hackify researchers have now established that the warning is correct, but the quality of the phishing emails is lower than feared. Hackify is a security company, but that is not the primary reason the organization can analyze the results of the Odido hack. A bit of (un)luck was involved.
After all, data from two researchers was included in the hack. Given their professional interests, those researchers followed best practices when creating an account. Instead of their regular email address, they used a unique email address via a so-called catch-all domain.
Catch-all
A catch-all domain allows you to use unlimited aliases without having to create them manually. If you have an email address like name@mydomain, you can register for services with unique addresses like odido@mydomain. All emails sent to the alias arrive at the main address, but within that main account, you can easily filter by the address actually used by the sender.
Traditional email services are also compatible with a form of catch-all. In Gmail, for example, you can add a ‘+’ to create unlimited variations of your primary email address (name+odido@gmail).
In the case of Hackify and the Odido hack, one alias with odido@ was in the leaked dataset, and one with tele2@. Tele2 is a company that was acquired by Odido in 2023. Both addresses were used only for that registration and were not known anywhere else.
Mailbox analysis
This allows the researchers to monitor whether spam suddenly arrives at those addresses. That was never the case before. If it were to start after the hack, it could only be because the addresses are circulating among criminals after the Odido dataset was shared.
The results confirm the suspicions. On March 12, less than two weeks after the publication of the stolen dataset, the first emails began rolling in to the odido address. Three days later, another followed a few days after that.
Over a period of 150 days, the Odido alias was sent 32 phishing emails and the Tele2 alias 29. The nature of the emails suggests that both addresses were circulating in different criminal circuits.
Low quality
Surprisingly, the quality of the phishing emails was not very high. Although the leaked dataset contained enough information to draft personalized emails, this hardly happened. Only in one email, supposedly from a bank, were the victim’s salutation, initial, and last name actually used.
The type of phishing emails varied in theme. Hackify concluded that AI was widely used to draft reliable-looking emails. In most cases, the quality of the Dutch was high.
Fortunately, techniques for combining data into more realistic emails do not yet seem ubiquitous, or at least not for this sample. Given the leaked data, criminals could have sent less generic emails. Think not only of using full names, but also mentioning things like IBAN and address.
When an email address appears in more than one hack, that data can also be combined. Anyone who always registers with the same address (presumably most people) runs that risk. Whether this happened could not be checked by the researchers using the unique email addresses.
Clear pattern
The pattern is clear: phishing campaigns started after the data leak and peaked in June. In July, the campaign stopped for unclear reasons. This confirms the suspicions: those whose data is present in a data leak can expect an increased barrage of malicious emails.
Being vigilant is always wise, and even more so in the months following a hack. Furthermore, there is little you can do as a victim. Those with access to catch-all addresses can follow the example of the security researchers and use a unique address every time. This has the advantage that after a hack, you can filter out all messages sent to that address from your mailbox.