Odoo Employee Database Allegedly Exposed and Put Up for Sale on Dark Web

A data breach has reportedly struck Odoo, a leading Belgian provider of open-source business management software.

On June 5, 2025, a 63.4MB employee database—allegedly sourced through a “collaborative effort with a senior insider”—was advertised for sale on a dark web forum.

The seller is demanding $25,000 in Monero (XMR) or Bitcoin (BTC) for the trove, which purportedly contains highly sensitive information on Odoo’s workforce.

This incident highlights a persistent challenge in enterprise resource planning (ERP) security: the insider threat.

According to recent industry research, 45% of data breaches in 2025 involved insiders, underscoring the critical need for robust access controls and vigilant monitoring of privileged accounts.

While Odoo implements advanced security features such as role-based access control (RBAC), two-factor authentication (2FA), and data encryption, employee access remains a primary risk vector for data exfiltration.

What Was Allegedly Leaked?

The seller’s listing describes a comprehensive set of data fields, including unique identifiers, personal and professional details, job roles, authentication tokens, and even geolocation data.

If authentic, the leak could expose Odoo employees to identity theft, phishing, and targeted attacks.

Below is a table summarizing the key fields reportedly included in the compromised database:

Field Name	Description	Example Data Type
id, odoo_id, odoo_employee_id	Unique record identifiers	Integer/String
emp_number, uniq_id	Employee numbers, unique IDs	String
full_name, email, password	Personal credentials	String/Hashed String
mobile, image	Contact and profile information	String/Binary
position_id, role_id	Job role and hierarchy references	Integer
odoo_leave_manager_id	Leave manager linkage	Integer
attendance_type_id, status_id	Attendance and employment status	Integer
user_type_id	User classification	Integer
remember_t	Authentication token	String
longitude_check_in, latitude_check_in	Geolocation for check-in/out	Float
check_in_location_from_google_map	Location string	String
email_verified_at, mobile_verified_at	Verification timestamps	DateTime
is_time_off_hr, work_time_type	HR and work schedule flags	Boolean/String
send_auth_code_first_time	2FA setup indicator	Boolean
work_phone, leave_manager_id	Additional contact and reporting info	String/Integer

Such detailed employee data, if validated, could enable sophisticated social engineering campaigns and facilitate unauthorized access to other business systems.

Security Best Practices and Odoo’s Response Protocol

Odoo, like other leading ERP vendors, employs a multi-layered security model.

Key technical safeguards include:

• Role-Based Access Control (RBAC): Ensures users only access data relevant to their responsibilities, minimizing the risk of privilege misuse.
• Two-Factor Authentication (2FA): Adds a second layer of account verification, mitigating risks from compromised passwords.
• Data Encryption: Protects sensitive information both at rest and in transit, reducing the risk of interception.
• Audit Logging and Monitoring: Tracks user actions and access patterns, enabling early detection of anomalous behavior.
• Regular Security Updates: Odoo’s security team issues advisories and patches in response to discovered vulnerabilities, following a responsible disclosure process.

However, as this alleged breach demonstrates, even the most robust technical controls can be undermined by trusted insiders with legitimate access.

Experts recommend regular access reviews, strict enforcement of the principle of least privilege, and continuous staff training to reduce the risk of insider leaks.

While the authenticity of the Odoo database leak remains unverified, the incident serves as a stark reminder of the persistent threat posed by insiders in modern enterprise environments.

Organizations leveraging Odoo or similar ERP platforms should review their access management policies, strengthen monitoring, and educate staff on data security to mitigate the risk of future breaches.

To Upgrade Your Cybersecurity Skills, Take Diamond Membership With 150+ Practical Cybersecurity Courses Online – Enroll Here