Vodafone confirmed the attacker got access to customer names, addresses, bank account numbers and birth dates in a database on the company's internal network, the BBC reported Thursday.
Customers had been informed of the data breach and warned to watch out for "phishing" messages attempting to extract more personal data, Vodafone said.
"Vodafone deeply regrets the incident and apologizes to all those affected," the company said in a statement.
The company said it did not believe the hacker or hackers stole sufficient information to raid bank accounts because they failed to access phone numbers, credit card details, PINs and passwords.
Vodafone, which has about 36 million customers in Germany, said a suspect has been identified and his home searched.
"This attack could only be carried out with high criminal intent and insider knowledge and was launched deep inside the IT infrastructure of the company," Vodafone said.