1. What Police Played Last Night

On Monday 7 September at 21:15 on NPO 2, Opsporing Verzocht aired audio from the Odido intrusion. Case number: PL2600-LOHAA26005. The Landelijke Opsporing en Interventies unit and the Landelijk Parket want tips, or the caller to turn himself in. A July appeal based on the same tape produced no surrender.
Police spokesman Thomas Aling said the man speaks “keurig Nederlands,” uses specific English IT jargon, and has voice traits a relative might know. A voice expert told investigators the recording is a real human, not a generated clone. That matters: “it sounded like AI” is not the defence here.
NOS summarised the method as “heel gewiekst.” The caller had already phoned Odido more than once. Other staff reported him to security. One conversation succeeded.

2. How the February Call Worked

Public reconstruction, from police, Odido and NOS — not a blueprint, a warning.
A Dutch-speaking man rang Odido customer service and said he was from IT. He used the vocabulary of a helpdesk: tickets, environments, a problem that had to be fixed now. He steered an employee to what looked like the company’s own login screen. It was a copy. She typed her username and password. He then asked for the extra code from the second factor. She gave it. “Then all the doors were open,” the police spokesman said on the programme.
Odido has said the compromised account was blocked within an hour. Two days later the group known as ShinyHunters emailed the company: they had millions of records. Internal checks on the day of the call had first concluded that nothing left the building. The scale only became clear after the dump. Ben customer data sat in the same systems.
This was social engineering plus a fake page plus a stolen second factor. No Hollywood “zero-day” is required once a person on the inside types into the wrong box.

3. The Voice: Not AI, Dutch, Says “Hoor”

Police and Opsporing Verzocht listed these marks:

July’s police update already pointed to possible Dutch involvement. The tape is the reason. Listen on politie.nl / the OV page if you think you know the cadence. Do not circulate home-made “suspect” identifications on Facebook groups.

4. What Was Stolen

Police and Opsporing Verzocht say data from 6.2 million Odido customers was stolen, making it one of the largest data thefts in Dutch history. After Odido refused to pay, the collection went onto the dark web. Reported fields include date of birth, bank account number, phone number and email. Business customers were in the pile as well; Odido has said that part became visible only when the full set was published in March.
A date of birth plus an IBAN plus a mobile number can be enough for a tailored phishing mail, a fake invoice, or a bank script that already knows your last four digits. That is why this story did not end in February.

5. The Phishing Wave That Followed

Opsporing Verzocht and follow-up reporting say leak victims have been bombarded with targeted mail for months. Security researchers who seeded unique addresses on Odido and Tele2 accounts counted dozens of campaigns: parcel “waiting,” unpaid invoices, a KVK registration about to lapse, a subsidy about to expire. The first messages arrived within two weeks of the customer notice.
Odido has said it cannot always prove a given mail came from this dump — brand phishing in the company’s name existed before February. For you the distinction is academic. If the mail knows your old Tele2 address and your invoice rhythm, treat it as hostile.

6. The Call You Will Get This Week

The February trick was aimed at staff. The copycats aim at you.
Typical scripts in the Netherlands in 2026:

Caller ID is cheap to fake. “Odido” on the screen is not proof. A fluent Dutch speaker with IT English is not proof either — that is the profile on the OV tape.

7. Hard Rules: Codes, Links, Callbacks

No legitimate bank, telecom provider or government employee should ask you to read out an SMS verification code, approve a bank push notification, or share your DigiD credentials. Those codes and approvals are critical security steps. The Odido employee who handed one over learned that in public.
If a caller creates urgency — “your number will be ported in ten minutes,” “we see a payment in Germany” — that is the tell. Real desks can wait while you hang up and dial the printed number.
Never install software because a voice told you to. Never log in through a link that arrived in the same chat as the warning. Type odido.nl yourself, or use the app already on the phone.

8. SIM-Swap and Number Porting

With a name, date of birth and current number from a leak, criminals may try to move the number to a SIM they control. If the number is successfully moved, they may be able to intercept SMS messages and use the number in account-recovery attempts. Call your provider only on the number printed on your bill or in the app and ask whether a port request is pending on the account. Turn on extra checks where Odido or your bank offers them. If SMS suddenly dies and the phone shows “no service,” call your provider from another handset as soon as possible.

9. How to Check If You Were in the Dump

Odido wrote to known customers after February. If you had a T-Mobile NL / Odido / Ben account then, assume your data may have been exposed until the company or an official data-check service says otherwise. Change the password on the email address tied to that account, especially if you reused it elsewhere. Change any other account passwords where you reused the same password. Contact your bank directly if you notice suspicious activity. Enable an authenticator app rather than SMS where the bank allows it.
Police and OV point victims to official “is my data still safe” pages linked from the OV article — use those, not a Google ad that says “Odido leak check.”
Watch the account for invoices you did not place, and the KvK if you are a freelancer whose mail was in the file.

10. If You Recognise the Voice

Give when and where you heard the person, not a theory. Do not confront someone you “think it is.”

11. If You Work on a Helpdesk

Police told employers after the broadcast: agree a procedure, and do not assume the person on the line is a colleague. Callback on a number from the internal directory, not from the caller. Second-factor codes are never read aloud to someone who phoned you. A ticket that cannot wait until you verify on a second channel is usually the ticket that should wait.
Expats working on first-line support in English-speaking teams should be especially careful with caller verification. The February caller mixed Dutch fluency with English jargon on purpose.