Telecoms company Odido has been storing personal information about former customers for far longer than allowed under privacy legislation, the Financieele Dagblad reported on Tuesday.

Odido was hit by a major hack last week in which information relating to up to 6.2 million current and former customers was stolen. The company says it only keeps data on former clients for a couple of years, but some of those who received an email saying their information had been stolen left Odido ten years ago, the paper said.

IT lawyer Jop Fellinger told the FD that if data which should have been deleted was still being stored, the company was in a much more serious position.

“A leak can happen and is awful, but there is something else going on here,” he said. “That is, a company which does not have its own data management under control. That does not sound good and it is not compliant with privacy law.”

Odido told the paper it needed more time to determine how and why old information about former clients was being kept.

The hack involved clients of Odido and its subsidiary Ben. T-Mobile Nederland and Tele2 Mobiel merged in 2023 under the name Odido.

Privacy watchdog AP said it is monitoring developments at Odido closely.