Major hack of Dutch telco Odido was a classic case of social engineering

"Criminals who broke into Dutch telecom provider Odido managed to deceive employees through phishing. They pretended to be the IT department in phone calls to bypass multi-factor authentication. 6.2 million customer files may have been stolen through automated scraping. It is yet another example of a data breach that circumvents strong security policies on paper. What now? The attackers gained access by logging into customer service employee accounts. They obtained the passwords through successful phishing attempts."

"They managed to obtain the customer data by means of scraping. It is unlikely that they were actually able to download all customer data, according to a source familiar with the hack who spoke to the NOS. "Extracting all customer data from this system takes a very long time, although it cannot be ruled out." Whether they succeeded depends on how long they were inside and how much customer data they managed to steal, security researcher Sijmen Ruwhof told the NOS."

"But the attackers didn't stop there. Once the criminals had the password, they called the employees. They pretended to be Odido's IT department and manipulated them into approving the fraudulent login attempt. This bypassed an extra security step that normally blocks unauthorized access. Since organizations of a certain size often have their basics in order, attackers have to be cunning."

Attackers obtained customer service employee passwords at Odido via successful phishing. They then called employees while impersonating the IT department and manipulated them to approve fraudulent multi-factor authentication prompts, bypassing that protection. The breach targeted Odido's Salesforce environment, where attackers used automated scraping to collect customer records. Up to 6.2 million customer files may have been exposed, though sources say downloading all records is time-consuming and uncertain. Security researcher Sijmen Ruwhof noted that scraping large datasets requires days of undetected access. The full scope remains unclear while Odido assesses how long intruders remained in the system.

Read at Techzine Global