A customer contact system at Odido, one of the Netherlands’ major mobile operators, was compromised over the weekend of 7 February 2026, affecting between 6.2 and 6.39 million customers. Personal and financial identifiers were among the reported data.
Weekends Are A Scheduling Decision
Intrusions concentrated on weekends and public holidays are not coincidence. Staffing is thinner, escalation paths are slower, and the people authorised to make disruptive containment decisions are harder to reach.
It is one of the few adversary behaviours a defender can plan against precisely, because it is predictable. The question any organisation can answer without a threat feed is: who can authorise disconnecting a production system at 3am on a Sunday, and how long does reaching them take?
Telecom Records Verify Everything Else
A mobile subscriber record is an unusually load-bearing identity artefact. The phone number is the recovery channel for a large share of a person’s other accounts, and the subscriber details are what a carrier checks before transferring a number to a new SIM.
That combination is what makes carrier data valuable beyond its face value: it supplies both the target and the answers needed to take control of the channel other services trust.
Graded medium — the affected range and window are consistently reported, the access route is not established.
Compiled from public reporting, listed below. Affected figures differ slightly between accounts and are given as a range. Corrections: corrections@forensicpost.com.
- List of recent data breaches in 2026Bright Defense