The investigation is still ongoing. As soon as more information becomes available, we will update this page.
Last update on March 3, 2026, 17.00 pm
The latest updates
March 2, 2026, 19.30 pm
Please be aware of a phishing email sent in Ben's name that references the cyberattack. The message urges you to click a link and fill in a so-called mandatory “compensation request form". This is not an Ben email. Do not click any links, do not provide any information, and delete the email. Official Ben emails on this topic are sent exclusively from info@mail.ben.nl and contactformulier@ben.nl. Always check the sender's email adress, not just the name you see.
February 26, 2026, 11.45 am
Our focus has always been, and continues to be, our customers. Following the guidance from leading cybersecurity experts and relevant government authorities, such as the police, Odido came to the decision not to engage in negotiations with these criminals or submit to their attempts at blackmail. We continue to put all of our efforts toward supporting our customers and our employees to the best of our ability.
Extra protection for you – free of charge
We want to support you. We want to offer some additional data protection free of charge.
You can activate the F‑Secure digital security package free of charge for 24 months. It gives your phone, tablet and computer extra protection against viruses, phishing and other online threats. You activate the package using a voucher.
Why this page?
Ben has been affected by a cyberattack, in which customer data has been impacted. This involves personal data originating from a customer contact system used by Ben. We are still investigating whether and to what extent other systems have also been affected. Based on what we know at this time, no passwords, call records, or billing information are involved. The investigation is ongoing. As soon as more information becomes available, we will share further updates via this page.
We deeply regret this incident and are fully committed to limiting the impact of this incident and providing our customers with all necessary support. It is important to emphasize that our operational services have not been affected; customers can continue to call and use the internet.
Unauthorized access to the system was ended as quickly as possible. In addition, Ben has engaged external cybersecurity experts to support the implementation of additional security measures as part of the response to this incident.
Affected customers have received an email directly from the email address info@mail.ben.nl or an SMS from Ben. If we determine that your data was impacted, and you have not already heard from Ben, we will inform you directly. Ben has also reported the incident to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP).
On this page we share more information about this incident, a frequently asked questions section, and any important updates. You can also read here about steps you can take yourself, in addition to the measures Ben has already taken.
Be extra alert for suspicious and unusual activities. Unfortunately, cyberattacks like this are becoming increasingly common and no organization is immune. Not every data breach leads to actual misuse, but we cannot rule out the possibility that your data may be misused.
Below are concrete situations where we ask you to be extra alert:
- With your name, address, phone number, email address and bank account number, cybercriminals may try to contact you while pretending to be someone from Ben, your bank, or another organization. Therefore, always remain alert to these kinds of phone calls, text messages, app messages, or emails.
- Be careful when opening links in emails, text messages, and app messages. You can often recognize a suspicious email, text message, or app message by typos and unknown senders. Check the phone number, or what appears after the “@” sign in an email address.
- Do you receive an unexpected call from a number you don’t know? It may indeed be an employee of your bank or another company calling. You can verify this by asking the caller for their first and last name and asking for the company’s general phone number. If in doubt, say you would like to verify first whether the person is a real employee and hang up. Then check the company’s website to see whether the number is correct. Is the number correct? Then call the company yourself and ask for the employee who called you.
- Never give anyone your password or PIN code.
- Always be alert when receiving invoices. Cybercriminals may exploit the situation by sending fake invoices that appear to come from Ben or other parties. Therefore, always carefully check the origin and accuracy of received invoices before proceeding with payment. For example, you can always view an Ben invoice in your “Ik Ben” environment. If in doubt, always contact us.
The email we sent you is decisive for your personal situation. It states exactly what applies to you.
The information involved may include:
- Full name
- Address and city of residence
- Mobile number
- Customer number
- Email address
- Date of birth
- Identification details (passport or driver’s license number and validity)
What information is not involved?
The information involved does not include:
- 'Ik Ben' passwords
- Call details (who you called, when)
- Location data
- Billing data
Scans of identity documents
The investigation is ongoing. As soon as more information becomes available, we will share further updates via this page.
We always want to be transparent with our customers, and we want to inform you so you can be alert to any unusual activities. We also want to emphasize that your security is our highest priority. Because of this incident, no one can view your mobile location data or your private contacts.
Ben is working together with external cybersecurity experts as part of our response to this incident.
- Security strengthened – After the discovery of the attack, unauthorized access to our system was immediately shut down. Ben immediately took additional security measures.
- Regulation & transparency – We reported the data breach to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP).
- Support – We want to help you. That’s why we have opened this special information page.
We would like to keep you informed via this web page about any important new information regarding this security incident. Our customers received a personal email or an SMS about this incident. Keep an eye on this information page in the coming period.
We understand you may have questions. Consult this page for the most up-to-date updates. Our customer service colleagues cannot provide any additional information at this time beyond what is shared here.
Again, we deeply regret this situation and are fully committed to providing you with all necessary support.
You are our customer, and your interests come first.
Søren Abildgaard
CEO Odido Netherlands (Ben is part of Odido Netherlands)
These FAQs may be supplemented. If you have new questions, first check out this information page to see if new information is available before contacting us.
About the incident
Cybercriminals were able to successfully gain access to our customer contact system. After the criminals gained access, they were able to download customer data in a covert and unauthorized manner. The investigation is ongoing. As soon as more information becomes available, we will share further updates via this page.
In the weekend of 7 and 8 February, we first received signals that there was a data breach. We immediately began further investigation together with our internal and external cybersecurity experts and took immediate action. As soon as the data breach was confirmed, we decided to inform the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and the affected customers as quickly as possible.
The data that was leaked differs per customer but may include name, contact details (name/address details, phone number), date of birth, customer number, and also email address, bank account number (IBAN), and identity document numbers and expiry date. Our investigation into exactly which data have been affected is still ongoing. As soon as more information becomes available, we will share further updates via this page.
Immediately after the cyberattack, we contacted the customers whom we determined had been affected. Our investigation is still ongoing. As it progresses, we are gaining an increasingly clear picture of which other customers may also have been impacted.
If our investigation shows that your data have been affected and you have not yet received a notification from Ben, we will contact you directly.
We take this incident very seriously. Immediately after discovering the data breach, we:
- Blocked the unauthorized access to the customer contact system.
- Implemented additional security measures.
- Further scaled up monitoring for unusual activity.
- Increased employee awareness of how cybercriminals operate (phishing).
The security of our infrastructure and our customers is our top priority. Our networks and systems are designed with security in mind. We are continuously working to improve our resilience. We work with external security experts to keep improving. However, cybercriminals operate in a highly advanced and targeted manner, and unfortunately no organization is immune. We continuously work on improvements and are using this incident as the reason for a thorough evaluation.
Our services have not been affected. Customers can continue to call, and use the internet, and use all other Ben services as normal.
Odido and Ben customers have been affected by the cyberattack. Odido has a separate information page: www.odido.nl/veiligheid. Simpel customers have not been affected.
We sent 4 versions of the same email to our customers, because the data that may have leaked can be different per customer. These 4 versions are:
- Only the name and address details were leaked.
- Name and address details and bank details leaked.
- Name and address details and ID details leaked.
- Name and address details and ID details, and bank details leaked.
It can happen in a household or a company where several different types of emails are sent. This is because there can be several accounts at one address. In general, it is wise to follow all the tips we give to be extra careful about all versions. Being extra careful is always better.
We emphatize that your Ik Ben password, your subscription details, your call details, your bill details or your location details, and any scans of identity documents are not part of the data leak.
We are in contact with various organizations regarding this data leak. However, for customers, it is currently most important to remain extra alert themselves. You can find our tips on this page.
The data leak itself is not a valid reason to terminate your agreement early.
We refer you to our website where you can find the available information. In short, we took the following steps to help customers prevent damage:
- Ended the unauthorized access.
- Personally informed customers by email and/or text message so everyone can be extra alert.
- Informed the Dutch Data Protection Authority about this incident.
- Brought external cybersecurity experts for extra support.
Immediately after the cyberattack, we contacted the customers whom we determined had been affected. Our investigation is still ongoing. As it progresses, we are gaining an increasingly clear picture of which other customers may also have been impacted.
If our investigation shows that your data have been affected and you have not yet received a notification from Ben, we will contact you directly.
Negotiations
We have made a careful and deliberate assessment. Both leading experts and government authorities have strongly advised us not to engage with this criminal group. This advice is based on extensive experience with this specific group.
Cybercriminals have indeed begun publishing part of the leaked data. We are closely monitoring these developments together with our external experts. As soon as we are able to share more information, an update will be posted on this information page.
Leaked data
With the leaked data, cybercriminals could, for example, try to:
- Impersonate customers or trusted companies – for example, posing as a bank or Ben and sending fake bills via phone or email.
- Phishing – fake emails, calls or SMS targeting customers or their contacts.
What they cannot do:
- - Use your passwords.
- - View your call history.
- - Track your location.
Be extra alert for unexpected phone calls, SMS or WhatsApp messages, and emails. Have you received a message and you’re not sure whether you can trust it? Visit odido.nl/phishing to learn what to look out for and find tips on how to recognize phishing. Also check your bills and bank account regularly. You can change your passwords if that makes you feel more comfortable, but this is not necessary: no passwords have been leaked. Our earlier advice to stay alert still applies.
In addition, you can activate F-Secure’s digital security package free of charge for 24 months. This provides extra protection for your phone, tablet and computer against viruses, phishing and other online threats. More information is available at https://www.ben.nl/ondersteuning.
The investigation remains ongoing. We understand that you are concerned. That is why we want to assure you that it is our utmost priority to ensure we are providing you with the most up-to-date information as possible. We will continue to provide updates on this page.
With email bombing, your email address is signed up in bulk for newsletters or online services, which can cause your inbox to fill up quickly.
Here’s what you can do:
- Block and delete these emails (if they haven’t already been stopped by your spam filter).
- Don’t click on links or “unsubscribe” buttons in suspicious emails.
- Check whether any important, legitimate messages are mixed in.
- Consider the F‑Secure digital security package (free of charge for 24 months) as extra protection against phishing and fake emails that can sometimes be hidden among a large volume of messages. Unfortunately, this won’t stop the email bombing itself, but it can help you identify suspicious links/attachments more quickly. More information: https://www.ben.nl/ondersteuning.
No. This is not an email from Ben. Please be aware of a phishing email sent in Ben's name that references the cyberattack. The message urges you to click a link and fill in a so-called mandatory “compensation request form". This is not an Ben email. Do not click any links, do not provide any information, and delete the email. Official Ben emails on this topic are sent exclusively from info@mail.ben.nl and contactformulier@ben.nl. Always check the sender's email adress, not just the name you see.
Bank account number
No, in our opinion, the data breach at Ben does not necessitate changing your bank account number. The Dutch Banking Association (NVB) has also emphasized that it is not possible to log in to your banking environment with a back account number, such as your banking app or online banking. Your bank account is therefore secure according to the NVB.
You can find the NVB's advice here: https://www.nvb.nl/nieuws/datalek-odido/
Identification details
To prevent fraud when taking out a mobile subscription, we always check your identity and therefore register the number of your identity documents. This way we know for sure that you are the one taking out the subscription, and we can show that it was you. This also helps prevent contracts, subscriptions, or phones from ending up with the wrong person. If you took out phone credit with Odido Finance, Ben is required by law to check your identity. We must record and keep the number of the identity documents you used to identify yourself for up to 5 years after your phone credit ends.
Ben’s data retention policies are outlined in our contracts as well as on our website, https://www.ben.nl/privacy.
As part of our investigation into this cyber-attack, we are also reviewing our data retention policies and processes. These investigations take time, and we will provide further information as soon as we are able to do so.
We want to emphasize that, based on our current information, no copies and/or scans of IDs are part of the data leak. We have also stated this earlier in our communications. Our investigation into exactly which data has been affected is still ongoing. As soon as we know more, we will share further updates on this page. We also want to point out that the Central Helpdesk for Identity Fraud has also stressed that a data leak does not automatically mean identity fraud, or that identity fraud can be done with the stolen data.
You can find the advice from the CMI here: https://www.rvig.nl/nieuws/12-02-2026-datalek-odido-veroorzaakt-ongerustheid-cmi-geeft-advies
No, based on our current information, replacing an identity document is not necessary at this time. We are following the current government advice from the Central Identity Fraud Reporting Centre (CMI).
You can find the CMI's advice here: https://www.rvig.nl/nieuws/12-02-2026-datalek-odido-veroorzaakt-ongerustheid-cmi-geeft-advies
We understand that this situation can be unpleasant and that you may want to take extra precautionary measures. Based on what we know today, replacing your passport or driver’s license is not necessary at this time. We are closely following the guidance from the Dutch authorities, including the Central Identity Fraud Reporting Centre (CMI). In line with their current advice, those documents do not need to be replaced, so we do not reimburse the costs of replacing these documents at this time.
We will continue to monitor the situation and the official guidance.
Login details
No, this is incorrect. We would like to emphasize that no passwords from Ik Ben or other login systems have been leaked. The passwords that customers use to log in are stored in encrypted form and have never been accessible. Your Ik Ben account is secure.
What has been leaked is a field from the customer contact system called “password_c”. Despite its name, this is not a password, but a so-called challenge word or code word. This was used as an additional security question when a customer contacted us by telephone. This code word does not give access to accounts, services or personal data and is completely separate from the systems in which customers log in.
Such an additional code word was registered for a limited group of customers. As soon as we heard that these code words were included in the leak, telephone verification based on these code words was immediately discontinued.
Our investigation is ongoing. As soon as more information becomes available, we will share further updates via this page.
Ben never sends messages asking you to change your password. Stay alert, and if you don’t trust a message, don’t take any action. For tips on how to recognize phishing, visit www.ben.nl/phishing.
Details of former customers
Not an active customer:
Ben keeps your contact details for up to 2 years after your contract ends, and you switch to another provider, in case you want to become a customer again within this period. We also say this in the privacy statement on our website. Because you switched less than 2 years ago, your details were still in the system, and that is why you received an email or text message.
Just cancelled:
To process your cancellation correctly, we still need your data to carry out your contract. Ben also keeps your data for up to 2 years after your contract ends, in case you want to become a customer again within this period.
You can find our privacy statement here: https://www.ben.nl/privacy.
Ben uses a period of 2 years in the system after all duties on both sides are finished. If you still had unpaid bills after you switched, or service questions that were not finished yet, the 2 years started when the bills were paid, and the questions were handled.
Ben has a standard process for requests to delete customer data. Only a small group of employees are allowed to handle these requests. We kindly ask you to follow our normal process for this. Only in this way can we also check the identity of the person making the request. We refer you to the form on our website: Privacy.
Compensation
Sorry to hear that you may have suffered damage because of an incident. Based on the information Ben has at this time, we have no reason to think that any damage is the result of the Ben data leak. If Ben informed you about the data leak, we refer you to our information page for all the tips we currently give to our customers.
Regarding compensation, we answer the following. A data leak does not automatically give a right to compensation. Our work is currently focused on preventing customers from suffering any damage because of this incident. We informed customers in advance so they can be extra alert for suspicious signs. This is in line with the advice of the Central Helpdesk for Identity Fraud (CMI) of the Dutch government. The CMI also emphasizes that identity fraud does not automatically apply, and that identity fraud cannot automatically be done with the stolen data. The CMI also says that with the affected data you cannot simply take out a loan, open a bank account, or take out a phone subscription. You also cannot request a new identity document with it. Extra checks are needed for that, such as a real identity document, your DigiD, or your bank login details.
You can find the full advice here: https://www.rvig.nl/nieuws/12-02-2026-datalek-odido-veroorzaakt-ongerustheid-cmi-geeft-advies
A data leak does not give automatically a right to compensation. Our work is currently focused on preventing customers from suffering any damage because of this incident. We informed customers in advance so they can be extra alert for suspicious signs. This is in line with the advice of the Central Helpdesk for Identity Fraud (CMI) of the Dutch government. Be careful with parties that give advice that is different from what the CMI advises.
You can find the full advice here: https://www.rvig.nl/nieuws/12-02-2026-datalek-odido-veroorzaakt-ongerustheid-cmi-geeft-advies
Contact
We understand that you may still have questions. We ask you to check this page for updates. Our customer service team is currently not able to provide more information than what can be found on this page.
If you do have urgent questions, please contact us.