Vishing Attack Tricks Odido Into Granting Access, Exposing 6.2M Customers
Written by AI from the linked story. Not reviewed by an editor. How this works
The Odido breach demonstrates how social engineering — specifically vishing (voice phishing) — can completely bypass technical security controls by exploiting human trust. Attackers impersonated an IT employee to manipulate staff into granting unauthorized access, after which they pivoted to steal data from connected SaaS applications via compromised SSO accounts. This incident highlights that even well-resourced organizations remain vulnerable when employees lack robust verification procedures for identity requests made over the phone. The scale of the breach — 6.2 million customers — underscores the catastrophic downstream impact of a single successful social engineering interaction. ShinyHunters' repeated use of this technique signals a proven, repeatable attack pattern that organizations must actively train against.
Tactical Insight
Immediate actions
- Implement a mandatory out-of-band identity verification protocol (e.g., callback to a known number) before granting any access based on a phone or verbal request.
- Audit all SSO-connected SaaS applications and revoke any access tokens or sessions that cannot be attributed to verified, legitimate activity.
- Brief help desk and IT staff immediately on active vishing campaigns targeting telecoms and similar sectors.
Long-term improvements
- Enforce phishing-resistant MFA (e.g., FIDO2/passkeys) on all SSO and privileged accounts to reduce the impact of socially engineered credential theft.
- Establish a formal Social Engineering Response Policy with clear escalation paths and zero-tolerance rules for verbal-only access grants.
- Apply least-privilege access principles to SaaS integrations so that a single compromised account cannot access bulk customer data.
Detection measures
- Deploy User and Entity Behavior Analytics (UEBA) to flag anomalous access patterns, such as large data exports from SaaS platforms outside normal working hours.
- Enable centralized logging and alerting for all SSO authentication events, including new device logins and privilege escalations.
- Conduct regular tabletop exercises simulating vishing scenarios to test and measure staff response effectiveness.