January – March 2026

Top Breaches

Odido was the defining breach of Q1. On February 12, Dutch telecom provider Odido disclosed that threat group ShinyHunters had stolen 6.2 million customer records through a vishing attack on their customer service infrastructure. By March 1, the full dataset — 6.5 million individuals, 600,000 companies, and over 5 million passport and identity documents — was published in full.

What followed was a textbook escalation. Within days, fraudsters launched phishing campaigns impersonating Odido customer service. SIM takeover attempts spiked. The Fraudehelpdesk issued a national alert. RTL and Follow the Money confirmed that Dutch government ministers appeared in the dataset. Have I Been Pwned was accessed over 2 million times by Dutch users checking their exposure.

We documented the full 30-day criminal timeline as it unfolded: from the initial breach disclosure through to the active fraud campaigns and practical steps for affected individuals.

Vishing dominated Q1 as an attack vector. ShinyHunters used the same SSO-hijacking phone call technique against Wynn Resorts, Match Group (Tinder, Hinge, OkCupid — 10 million records), and an Ericsson vendor (15,000 records). In each case, a single phone call to an employee was enough to disable endpoint detection and harvest credentials. We broke down exactly how these calls work — MGM's $100 million loss and M&S's £300 million cost started with conversations shorter than a coffee break.

Other notable breaches: IDMerit exposed approximately 1 billion KYC records from 26 countries through an unsecured database. The Ivanti zero-day (CVE-2026-1281, CVSS 9.8) breached the Dutch Data Protection Authority and the European Commission — the regulators themselves.

Data Broker Developments

The academic evidence caught up with what practitioners already knew. The PoPETs 2025 study measured automated data broker removal services at a 48.2% average success rate — meaning more than half of removal requests fail or are silently re-listed.

The EDPB published its first Market Study on the data broker ecosystem in March 2026, signalling that regulatory attention is finally arriving. Enforcement continued in parallel: CNIL fined Solocal €900,000 for data broker violations, and Clearview AI now faces criminal charges in multiple EU jurisdictions.

A quieter development may prove more significant: data brokers are now selling AI chatbot transcripts — including health consultations, legal conversations, and financial discussions. This is not a breach. It is legal data commerce enabled by consent mechanisms most users never read.

We published a complete EU data broker opt-out directory covering 75 brokers across AdTech, B2B, and data aggregator categories, alongside our existing step-by-step opt-out guide with direct removal links.

Meanwhile, Google shut down its Dark Web Report on February 16. Millions of users who relied on breach monitoring through their Google account now have no coverage — and threat actors are aware of the gap.

OPSEC Recommendations

Three actions worth taking this quarter:

1. Audit your linked messaging devices. Dutch intelligence flagged a Russian campaign hijacking Signal and WhatsApp accounts at scale — not by breaking encryption, but by compromising the account layer. Open Signal → Settings → Linked Devices. Remove anything you don't recognise. Do the same for WhatsApp Web sessions.

2. Establish a vishing protocol. The dominant attack of Q1 was a phone call. No organisation should process credential resets, MFA changes, or EDR modifications based on a phone request alone. If your team doesn't have an out-of-band verification step for these requests, add one now.

3. Run a forgotten-account audit. The accounts you stopped using years ago are the ones most likely to appear in breach databases — and the ones least likely to have current security settings. A 30-minute sweep through your password manager for dormant accounts is the highest-return privacy action most people skip.

Threat Landscape Overview

Ransomware on-chain payments dropped to $820 million in 2025, down from the $1.25 billion record in 2023. But the market did not shrink — it fragmented. February 2026 saw 680 victims across 54 active operations. DragonForce emerged as a graduated exfiltration cartel, staging data publications in escalating pressure campaigns.

Law enforcement scored two significant wins: the LeakBase stolen-data forum (142,000 members) was seized in a 17-country operation, and the Tycoon 2FA phishing-as-a-service platform — responsible for 62% of Microsoft-blocked phishing — was taken down. Neither disruption is likely to be permanent. Operators are expected to rebuild or migrate.

The EDPB's 2026–2027 Work Programme signals a shift toward "making GDPR compliance easier" — five regulatory adjustments that could reshape how the Digital Omnibus interacts with existing data protection rules. Worth watching closely in Q2.

If any of these developments affect you or your organisation, reply to this email or request a complimentary Snapshot Scan — a quick assessment of what's already exposed.

— Privacy Insight Solutions