Spokesman Alexander Leinhos says an unidentified IT systems administrator who worked for a company contracted by Vodafone conducted the attack.
Vodafone said in a statement today that the stolen data included customers' names, addresses, date of birth and bank details. Credit card information and passwords weren't stolen.
Vodafone said it regretted the incident and warned its customers to be on guard against unsolicited phone calls or emails from people seeking to exploit the stolen data.
The company has more than 32 million cellphone customers and more than 3 million broadband subscribers in Germany. It is a wholly owned subsidiary of Vodafone Group Plc.