One Phone Call Can Open the Door to Your Business
You can have the best firewall money can buy and still lose your data to a stranger with a phone. That is what happened to millions of people this year, and it is worth five minutes of your attention.
The call that cost millions of people their data
Security reporter Zack Whittaker recently walked through a string of breaches that started the same way: a phone call. In the Dutch telecom Odido case, a hacker reportedly called a customer support agent and used a fake login page to grab that agent’s credentials. The result was the theft of personal data on more than six million people, which Dutch authorities describe as one of the biggest data thefts in the country’s history. Dutch police have even released a reconstruction of the call and are asking the public to help identify the caller.
It was not a one-off. The same reporting points to a Google employee who was tricked into giving access to a database of customer contact information, and to similar phone-based breaches at Cisco, Charter, and RingCentral. These are big companies with big security budgets. A phone call got around all of it.
Security people call this “vishing,” short for voice phishing. Think of it as phishing with a human voice. And here is the part that should get your attention: the top vishing groups are not even using fancy AI. They are using a confident tone, a little research, and a believable story.
Why small businesses are an easy target
You answer the phone, and so does everyone else
Attackers do not need to be clever with your systems if they can be clever with your people. A receptionist, an office manager, or a new hire answers a call that sounds urgent and official. Nobody wants to be the person who made the “IT guy” wait.
Small teams run on trust
In a ten-person company, everyone knows everyone. That is a strength, until a caller says “Hi, it’s Mike from the bank, I’m calling about the wire” and nobody has a way to check. Without a simple verification habit, the caller wins by default.
One password opens a lot of doors
In the Odido case, one support agent’s login was the key. In your office, one stolen email password can reach your files, your invoices, and your customer list. Our post on how one click exposed 1.3 million Arizonans shows how fast a single mistake spreads.
What a vishing call sounds like
The stories change, but the pattern does not. Watch for a caller who creates urgency (“this has to happen in the next ten minutes”), claims to be IT, your bank, your software vendor, or a coworker, asks you to reset a password, read out a code, approve a login prompt, or click a link they are texting you, and gets irritated when you want to double-check. That last one is the biggest red flag. Real vendors and real banks expect you to verify them.
What you can do this week
- Adopt the hang-up-and-call-back rule. If anyone calls asking for access, money, or a password, hang up and call back on a number you already know is real, not the one they give you.
- Make password resets harder to fake. Decide that nobody resets a password or changes bank details over the phone without a second check, such as a manager’s approval or a known callback number.
- Never read out a code. Verification codes and login approval prompts are for you only. No legitimate person needs them from you over the phone.
- Turn on strong sign-in protection. Multi-factor authentication helps even when a password leaks. We cover the basics in our small business cyber security solutions.
- Train your team for ten minutes. Tell this story at your next huddle. Our cybersecurity awareness training includes phone scenarios, because people remember stories better than rules.
- Back up your data and protect your devices. If a call does go wrong, you want secure data backups and endpoint protection already in place. A good spam and virus filter also cuts down the phishing emails that often come right before the call.
The bottom line
The Odido breach was not a story about advanced hacking. It was a story about a phone call that worked. Your best defense is not another gadget. It is a team that knows it is okay to say, “Let me call you back.” If you want help setting up simple verification rules for your office, that is exactly the kind of thing we do. You can also browse more plain-English tips on our blog.
Source: This Week in Security, “How a phone call allowed a hacker to steal millions of people’s personal data” (Sept. 30, 2026).
Not sure your team would catch a fake call?
We will walk through your office, your phones, and your sign-in settings, free. Book a complimentary visit and we will show you where the gaps are.
Send us a message
— Nemuel Cruz, Incognito Cyber Security
