Dutch police have added the email addresses of Odido customers to a website where people can check if their data has been published by hackers who breached the company’s security last month.

Personal details of at least five million people, including addresses, telephone numbers, social security (BSN) numbers and driving licence numbers, were stolen after hackers posing as IT workers accessed the company’s web servers.

The website, Checkjehack, allows people to type in their email address to see if they have been affected by recent data breaches, including the mass Odido breach.

If their account has been compromised, police will send them an email alerting them and advising them on what steps they can take to improve their cybersecurity.

The hackers demanded a ransom of €1 million and began publishing the stolen data online over the weekend after the company refused to pay.

The release of confidential information increases the risk of criminals obtaining people’s emails and sending out phishing mails, designed to trick people into giving them access to bank accounts or other secure sites.

Phishing risk

Experts also warned that criminals were sending out emails to Odido customers claiming to be from the company’s helpdesk and promising them compensation.

Some customers told RTL they had had phone calls from criminals who used an AI-generated voice to tell them they could make a compensation claim by staying on the line. They then attempted to obtain the customer’s bank details.

Other criminals set up fake websites promising compensation, but customers first had to pay a €50 “fee”.