Odoo Cloud customers get an urgent data breach email: what to do now

If you are an Odoo customer, you have probably received an urgent email this Saturday, 24 October 2026, telling you about a data breach affecting Odoo Cloud.

Beyond that notice, SentriXa has not yet seen a detailed public statement from Odoo on what was accessed, how, or which customers are affected. We will update this story as Odoo publishes more. Until then, treat it as an active incident and assume your account could be concerned.

Start by checking that the email you received is genuine. Breach notices are a favourite phishing lure: within hours of a real incident, attackers send lookalike messages asking customers to "verify" their account or reset a password. Do not click links in the email. Open your Odoo database by typing its address yourself, and check Odoo's official website and support channels for the notice.

Then lock down access. Change the password of every Odoo user, administrators first, and turn on two-factor authentication for all of them. Revoke and recreate API keys and the tokens used by integrations (e-commerce, payment, accounting and email connectors), and remove any user or connected app you do not recognise.

Next, look at what your database holds. A cloud ERP usually contains customer and supplier contacts, invoices, bank details and sometimes employee records. If personal data may have been exposed, the GDPR can require you to notify your data protection authority within 72 hours of becoming aware of the breach, and to inform the people concerned when the risk to them is high. Write down when you received the notice and what you checked.

Finally, warn your team, customers and suppliers. Stolen business contacts are quickly reused for invoice fraud: expect emails that look like they come from your company asking to change supplier bank details or pay a "new" account. Confirm any such request by phone, on a number you already know.