InfoSecBulletin Cybersecurity for mankind
Cybercriminals leaked over 1 million customer records from the Dutch telecom company Odido after their extortion attempt failed. The group ShinyHunters took responsibility for the attack, which resulted in data being released in two waves on February 25 and 26, 2026. The breach affected 688,100 accounts, exposing names, addresses, bank details, and IDs.
Odido confirmed the breach in an official notice on February 27. “We regret this incident. Not all records show full details, but some include passports, licenses, birth dates, and bank info,”
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
ShinyHunters released 1 million records with 317,000 unique emails initially, followed by another million and 371,000 emails on day two. They asked for ransom, but Odido declined. The data was then posted on BreachForums.
“We have nothing to add to that,” the Shinyhunters hackers respond to RTL Nieuws. “Enjoy the daily data breaches in the coming days! More sensitive data will appear every day.”
Leaked Data Types
| Data Field | Risk Level | Notes |
|---|---|---|
| Full names, addresses | High | Targets for phishing |
| Phone, email | High | Spam, scams |
| Bank account numbers | Critical | Direct fraud |
| DOB, passports, licenses | Critical | ID theft |
| Internal support notes | Medium | Social engineering |
Odido customers with accounts created before 2026 should take urgent precautions:
Monitor bank accounts for unauthorized transactions
Be alert to phishing emails or suspicious calls impersonating Odido or financial institutions
Consider placing a fraud alert with their bank
Check their exposure via the HIBP platform at haveibeenpwned.com
Update passwords and enable multi-factor authentication on linked accounts
Recently, Google’s Threat Intelligence Group, Mandiant, and their partners disrupted a global espionage campaign linked to a suspected Chinese threat actor UNC2814. This group used SaaS API calls to disguise malicious traffic in attacks against telecom and government networks globally.
The campaign has been ongoing since 2023 and has affected 53 organizations across 42 countries, with potential infections in at least 20 additional countries.
