Fact: Odido’s Customers personal information were leaked and are now in the hands of bad actors ready to be exploited. Per Odido unsigned email and bulletin (https://www.odido.nl/veiligheid-eng) several data are out there, the data includes:
The information involved may include:
-
Full name
-
Address and city of residence
-
Mobile number
-
Customer number
-
Email address
-
IBAN (bank account number)
-
Date of birth
-
Identification details (passport or driver’s license number and validity
Allegedly a customer service operator was victim of phishing and exposed his credentials which led to the hackers to obtain access to the entire database.
Fact: When I subscribed for Odido services the front desk operator wanted to take pictures of my Passport and picture of my credit card, I refused for the credit card and I simply provided a screenshot of the bank account number from the app, evident the bad practice of taking pictures of ID and Credit Cards, potentially those may be along the leaks.
I have several questions:
- Is the Customer Service front-end or the database accessible from Internet? Obviously yes and that’s a very bad practice.
- Were there in place measures to re-authenticate the operator’s account for every “new customer” query? Obviously not, if they managed to leak 8 million accounts. Another bad practice in place, each query must be re-authenticated, that would have prevented or at least slow down the exfiltration process.
- IDS/NOC did report an anomalous amount of data transferred?
- When Odido become aware of the leak? Yes, we know the 12th is the day they reported to the Authorities but when they discovered and “investigate” it before reporting?
Risks: While Odido is trying to make it sound as not that risky condition, bad actors having the ID/Passport number with expiration, the Bank Account number and obviously the Name can activate other services everywhere in Europe potentially Worldwide and have them charged to the bank account number, all will match.
Phishing campaigns with legit data can be conducted to obtain access to other places the person is subscribed and exploit them.
Surely Odido must give a better response to the customers, on my side contract will be closed, trust is no longer there.
Note that changing your ID won’t change the possibility of Identity Theft, I would rather change the bank account number if possible.
