Bold claim: A major data breach isn’t just numbers on a screen—it puts real people at risk, including victims of stalking and domestic violence. And this is where it gets controversial: the way data was handled could have amplified harm. Here’s a clear, beginner-friendly rewrite that preserves all key facts while expanding explanations and keeping a professional, engaging tone.
Hacker collective ShinyHunters has continued releasing stolen Odido customer data online for a third consecutive day. The previous batch, which RTL reported contained highly sensitive information about stalking and domestic violence victims, underscored that the breach could translate into tangible safety risks beyond mere privacy violations.
Odido says the breach affected 6.2 million current and former customers, with personal details such as names, addresses, phone numbers, dates of birth, bank account numbers, and ID numbers exposed. The hackers claim they breached information from over 8 million individuals and have demanded more than one million euros in ransom, threatening to publish one million data lines per day until Odido pays. Odido has refused to pay and says they will not comply with the ransom.
The hackers warned that they will release additional Odido data over the next two weeks if their demands aren’t met. RTL’s reporting indicates that the second batch includes detailed internal customer notes describing stalking, threats, domestic violence, and protected addresses. At least five people are named as being stalked by an ex-partner, while other entries involve domestic abuse or customers whose addresses were shielded for safety. In total, sensitive information affecting 13 individuals was identified, ten of whom had recent contact with Odido within the last six months. The majority of the victims are women. Experts emphasize that privacy-protective measures such as keeping phone numbers and home addresses secret are crucial in these situations, and the public availability of this data severely heightens risk.
A Veilig Thuis spokesperson told RTL that it is both bizarre and extremely worrying that such sensitive information about stalking and domestic violence victims has been exposed. The data isn’t ordinary personal information; it directly concerns an individual’s safety, and public access to these details can heighten fear and insecurity.
Veilig Thuis added that perpetrators, especially ex-partners, actively seek personal information to re-establish contact or exert control. When this kind of data is exposed, it becomes easier for those with malicious intent to misuse it, making the situation particularly dangerous for people who are already trying to rebuild their lives.
Police response: Dutch authorities say they are not aware of specific stalker-victim data being published. Stan Duijf, head of Special Operations at the national police, told RTL that stalking victims should contact the police for assistance and that the public should remain vigilant for suspicious emails, phone calls, or messages. He encouraged people to verify suspicious communications and perform extra checks before sharing information.
Authorities are pursuing two main goals: identifying the perpetrators and limiting further data distribution. Duijf noted that the speed of the internet can outpace law enforcement at times, and the origin of the hackers remains unknown.
Odido reportedly stored sensitive notes in a free-text field within its internal customer system. These notes included instructions not to disclose a customer’s home address, along with reasons such as stalking, domestic violence, or harassment.
Veilig Thuis stressed that data about stalking and domestic violence is inherently vulnerable. Organizations should constantly question whether it is necessary to record such information, how long it is kept, and whether the security surrounding it is truly adequate.
The stolen data is no longer confined to the dark web; ethical hacker Sijmen Ruwhof stated that it is now accessible on the open internet with a single click. Anyone with an internet connection can download the leaked data without specialized software.
Odido released a brief statement saying it would not comment on whether domestic-violence or stalking-related data is included. The company advised anyone feeling unsafe to contact the police and offered assistance for customers to check if their data was published and, if needed, to obtain a new phone number.
Previously, the hackers published hundreds of thousands of records on the dark web on Thursday and Friday. NOS reported that the breach likely occurred through phishing attacks targeting Odido’s customer-service employees, though Odido declined to confirm the method.
Controversy note: This incident raises a critical question about organizational data practices—should highly sensitive notes about victims be stored at all, and if stored, how should they be protected and retained? Would stricter data-minimization and stronger access controls reduce risk in similar breaches?
Would you like this rewritten version to emphasize actionable takeaways for readers (such as steps individuals can take to protect themselves) or to add a short explainer on how data breaches like this typically unfold and respond best?
