Police release the voice of the man who talked his way into Odido

The man who stole the details of more than 6 million Odido customers did not break anything. He picked up the phone, called the company’s own helpdesk, and said he was a colleague from the IT department with a problem to fix. Police have now released a recording of his voice, because they have been unable to identify him any other way.

The theft happened in early February and is, in the police’s own description, one of the largest data thefts in Dutch history. The criminal group demanded a ransom. Odido refused to pay. The data was then published on the dark web.

How one phone call opened the door

Investigators at the national investigation unit, working under the national public prosecutor’s office, established that a Dutch-speaking man rang Odido’s customer service and presented himself as an IT colleague. Police describe what happened next in some detail, and it is worth reading slowly, because nothing about it is sophisticated.

The caller said a problem needed solving and that this required logging in to an internal system. He used so much internal terminology that the employee genuinely believed a colleague was on the line. Following the details the caller gave, the employee arrived at a rebuilt copy of an Odido login page and typed in a username and password, which went straight to the man on the phone.

One step still stood in the way: a verification code. The employee entered that too. With it, the group was inside Odido’s internal systems.

The suspect then told the employee the problem had been fixed. The two thanked each other and hung up.

This is the part worth carrying away, whichever provider you are with: two-factor authentication did not fail. It worked exactly as designed, and it made no difference, because a person read the code out to someone who sounded like a colleague.

What the voice sounds like

Police said in July that they held audio of the call and asked the man to come forward. He did not. The fragment was broadcast on Monday evening on the national appeals programme, and police published it alongside a description of the speaker.

According to that description the voice is real and not generated by AI. The speaker is Dutch, has a working knowledge of IT, uses specific English-language jargon, and has a verbal tic: he ends sentences with the Dutch filler word “hoor”. Investigators have also found indications that Dutch nationals were involved in the attack.

If you think you know the voice

The recording is on the police appeal page under case number PL2600-LOHAA26005. Tips can go to the police tip line on 0800-6070, anonymously to Meld Misdaad Anoniem on 0800-7000, through the online tip form, or via the Telegram channel @Veiligmelden.

Police have also repeated their standing advice to companies hit by this kind of attack, which Odido followed: do not pay.