ShinyHunters escalate vishing-led extortion across tech and telecoms

Du'aine Davis

Observed in the wild

• In February, the ShinyHunters-linked activity targeted Optimizely, a global ad‑tech firm, via a contained breach of internal business systems, and Dutch telecoms provider Odido, where attackers exfiltrated customer contact data affecting ~6.2 million users, later claiming up to 21 million records. Both incidents involved data theft followed by extortion threats
• ShinyHunters used aggressive social engineering, notably voice phishing (vishing), to harvest SSO and MFA credentials, enabling access to SaaS platforms such as Salesforce and Zendesk. At Odido, attackers accessed customer contact systems and attempted double‑extortion via a dark‑web leak site, pressuring the victim with data‑release threats.
• Organisations are advised to harden identity security: enforce phishing‑resistant MFA, enable Microsoft Defender for Identity to detect anomalous credential use, monitor Defender for Cloud Apps for unusual SaaS access, and deploy Defender XDR alerts for vishing‑linked account takeover behaviours.

Odido informs customers of cyber attack

ShinyHunters extortion gang claims Odido breach affecting millions

Ad Tech Company Optimizely Targeted in Cyberattack - SecurityWeek

Du'aine Davis

ShinyHunters Publish Full Odido Dataset in Record‑Scale Dutch Breach
Observed in the wild

• In late February–1 March, ShinyHunters released what they claim is the full stolen Odido dataset online. The new development is scale: a final dump added ~4.6 million unique email addresses, bringing confirmed exposure to ~6.1 million unique accounts across four releases, impacting current and former customers of the Dutch telecom.
• The ShinyHunters extortion group accessed Odido systems in mid‑February 2026 and conducted staged data leaks via its Tor leak site after ransom refusal. The final publication consolidated earlier releases into a single dataset, significantly increasing downstream risk (phishing, identity fraud) due to breadth rather than novel techniques.
• Organisations are advised to prioritise identity‑centric monitoring: enable Microsoft Defender dark‑web and identity theft monitoring for exposed attributes, heighten Defender for Office 365 phishing detection for breach‑related lures, and correlate identity alerts in Microsoft Defender XDR to detect misuse of leaked personal data.

ShinyHunters leaked the full Odido dataset