Oh, oh Odido. What happened there?

𝘕𝘦𝘷𝘦𝘳 𝘸𝘢𝘴𝘵𝘦 𝘢 𝘨𝘰𝘰𝘥 𝘤𝘳𝘪𝘴𝘪𝘴.

A data breach affecting 6.2 million customers (according to the cybercriminals themselves 10 million). Odido became the victim of one of the largest data breaches in Dutch history.

Odido’s decision not to pay the criminals was probably the only right one. Financing cybercrime only helps sustain the system behind it. But while the decision not to pay was the correct approach, the communication around it was not. In a situation like this, a newsletter with a purely factual explanation is not enough. The feelings and interests of millions of customers were completely overlooked. As a result, it is not the criminals but Odido that is increasingly seen as the cause of the misery.

Communication in times of crisis

This data breach could have been positioned as a symptom of a growing phenomenon: cybercrime that threatens our society, from organisations to individuals. Odido could have positioned itself as a victim of a system that affects us all. With a clear moral stance: we do not pay criminals because we refuse to be part of an industry that is digitally holding the Netherlands hostage.

Had Odido chosen this approach, the narrative would have shifted. From a failing company to an organisation taking a stand against a shared enemy.

Make trade-offs transparent and provide context

Look at how Nederlandse Spoorwegen communicated earlier this winter about snowfall and the disrupted timetable. The core of their message was simple and transparent: the Netherlands rarely experiences extreme snowfall. Investing at Alpine levels for a scenario that only occurs sporadically would require enormous financial resources. Better to accept a small chance of disruption than permanently higher prices for travellers. That trade-off was made transparent. The public received context. Understanding followed. In fact, people felt comfortable with the choice. The criticism about cancelled trains faded almost immediately.

In this case, Odido should have done three things. First, frame the problem as larger than the company itself. Then explicitly choose the role of advocate rather than culprit. And finally involve the public in the decision not to pay ransom, making them part of the fight against cybercrime.

People accept setbacks when they feel they are part of something bigger. Those who feel connected to a collective struggle behave differently from those who feel like victims.

Missed opportunity

Odido had an opportunity to show leadership on the issue of cybersecurity. To visibly join forces with government and specialists in the fight against digital crime. To turn this crisis into a moment of positioning.

That opportunity was missed. This crisis was wasted.