[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flxkq77UWFl_DfX55Sp7sA5Izrk9DdW_sCBhuKWjytuw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":28,"status":29,"created_at":30,"published_at":31,"article":32,"tags":36,"podcasts":55,"controls":62},"deed196e-7ac6-4f37-a04c-40a4f656c6cd","vishing-attack-tricks-odido-into-granting-access-exposing-62m-customers","da39d6b0-20b2-4fc1-948c-ee73b4aecab0","Vishing Attack Tricks Odido Into Granting Access, Exposing 6.2M Customers","The Odido breach demonstrates how social engineering — specifically vishing (voice phishing) — can completely bypass technical security controls by exploiting human trust. Attackers impersonated an IT employee to manipulate staff into granting unauthorized access, after which they pivoted to steal data from connected SaaS applications via compromised SSO accounts. This incident highlights that even well-resourced organizations remain vulnerable when employees lack robust verification procedures for identity requests made over the phone. The scale of the breach — 6.2 million customers — underscores the catastrophic downstream impact of a single successful social engineering interaction. ShinyHunters' repeated use of this technique signals a proven, repeatable attack pattern that organizations must actively train against.","**Immediate actions:**\n- Implement a mandatory out-of-band identity verification protocol (e.g., callback to a known number) before granting any access based on a phone or verbal request.\n- Audit all SSO-connected SaaS applications and revoke any access tokens or sessions that cannot be attributed to verified, legitimate activity.\n- Brief help desk and IT staff immediately on active vishing campaigns targeting telecoms and similar sectors.\n\n**Long-term improvements:**\n- Enforce phishing-resistant MFA (e.g., FIDO2\u002Fpasskeys) on all SSO and privileged accounts to reduce the impact of socially engineered credential theft.\n- Establish a formal Social Engineering Response Policy with clear escalation paths and zero-tolerance rules for verbal-only access grants.\n- Apply least-privilege access principles to SaaS integrations so that a single compromised account cannot access bulk customer data.\n\n**Detection measures:**\n- Deploy User and Entity Behavior Analytics (UEBA) to flag anomalous access patterns, such as large data exports from SaaS platforms outside normal working hours.\n- Enable centralized logging and alerting for all SSO authentication events, including new device logins and privilege escalations.\n- Conduct regular tabletop exercises simulating vishing scenarios to test and measure staff response effectiveness.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27],"CIS Control 4 – Controlled Use of Administrative Privileges","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 16 – Application Software Security","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-17 – Remote Access","NIST SP 800-53 IA-4 – Identifier Management","NIST SP 800-53 SI-10 – Information Input Validation","NIST SP 800-61 – Incident Response Guide","NIST CSF PR.AC-1 – Identities and Credentials Management","GDPR Article 5(1)(f) – Integrity and Confidentiality","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of a Personal Data Breach","ITIL Service Operation – Access Management","MITRE ATT&CK T1566.004 – Phishing: Vishing","MITRE ATT&CK T1078 – Valid Accounts",{},"published","2026-07-10T18:20:59.920479+00:00","2026-07-10T18:20:59.526+00:00",{"id":7,"url":33,"slug":34,"title":35},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fpolice-suspects-dutch-hackers-were-involved-in-odido-breach\u002F","police-suspects-dutch-hackers-were-involved-in-odido-breach-d5e2d6","Police suspects Dutch hackers were involved in Odido breach",[37,43,49],{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":44,"name":45,"slug":46,"description":47,"color":48},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":50,"name":51,"slug":52,"description":53,"color":54},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[56],{"id":57,"date":58,"edition":59,"title":60,"audio_url":61},"4bc7bde0-bbe2-4d91-8f60-ff0ea8497124","2026-07-11","morning","ThreatNoir Weekend Brief — July 11","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-07-11\u002Fthreatnoir-morning-brief-2026-07-11.mp3",[63,67,71],{"slug":64,"name":65,"problem":66},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":68,"name":69,"problem":70},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":72,"name":73,"problem":74},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]