Spokesman Alexander Leinhos says an unidentified IT systems administrator who worked for a company contracted by Vodafone conducted the attack.
Vodafone said in a statement today that the stolen data included customers' names, addresses, date of birth and bank details. Credit card information and passwords weren't stolen.
Vodafone said it regretted the incident and warned its customers to be on guard against unsolicited phone calls or emails from people seeking to exploit the stolen data.
The company has more than 32 million cellphone customers and more than 3 million broadband subscribers in Germany. It is a wholly owned subsidiary of Vodafone Group Plc.
Photos: Shraddha Kapoor, Kim Sharma at 'Haseena Parkar' screening
Mumbai to Goa train: First look at the glass-top Vistadome coach
Shuttler Ashwini Ponnappa keeps it short and sexy on social media
Photos: Narendra Modi, others at Marshal Arjan Singh's funeral
Photos: Sussanne Khan and Nimrat Kaur spotted at a spa in Juhu