The Dutch police suspect that Dutch hackers were behind the cyberattack on Odido earlier this year. They posed as IT staff from the company.
In February, the Dutch telecom provider was hit by a cyberattack. According to a public statement from the Dutch police’s High Tech Crime team, there are indications of Dutch ‘involvement’. The police are hoping for tips that could help track down the perpetrators.
The Russian group ShinyHunters claimed responsibility for the attack and has already leaked part of the stolen customer data. ShinyHunters is one of the most active groups at the moment and has an impressive list of victims, including Google and the European Commission. A typical method used by the group is posing as the company’s IT staff to deceive employees.
Suspicious phone call
The attack on Odido shows a similar pattern, according to the preliminary investigation. A Dutch-speaking man reportedly called customer service shortly before the hack, posing as an IT employee. The company was then misled via phishing, after which the data breach occurred. Who the man is, whether he is part of the ShinyHunters network, and whether there are other (Dutch) parties involved is all still under investigation.
The data of more than 6 million Odido customers was exposed by the cyberattack. This included names, phone numbers, account numbers, and ID card details. According to the company, call records, scans of identity documents, billing details, or passwords for Odido accounts were not affected.
According to the Dutch police, the investigation will take at least several more months. The police suspect that the person(s) involved have spoken about the attack within criminal circles or their social environment. Presumably, there are people who know the identity of the attacker(s). “This type of investigation is often complex and takes time, but cybercriminals are also vulnerable and leave traces,” says Stan Duijf, who is closely involved in the investigation as Head of Operations within the National Unit for Investigation and Intervention.