Breaches and incidents
Dodo Pizza (Russia): pizza chain confirms breach of customer data claimed by DataSuckers; suspects later arrested
Dodo Pizza confirmed a cyberattack on its IT system and said attackers may have accessed some customers’ names, contact details, addresses, dates of birth...
- Disclosed
- Verification
- Confirmed by two or more outlets
What happened
- Dodo Pizza confirmed a cyberattack on its IT system and said attackers may have accessed some customers’ names, contact details, addresses, dates of birth and order details (SecurityLab, 28 Sep; The Record, 29 Sep); it did not give a count.
- Root cause: not disclosed by Dodo; per The Record (16 Oct, citing reports), attackers found corporate credentials exposed on GitHub and used them to reach cloud storage and databases.
- DataSuckers claimed the attack, claiming 68 million customer records (The Record) or 2 to 3 TB (SecurityLab), neither independently confirmed; on 16 Oct The Record reported a Moscow court placed suspected member Denis Fridman, 19, under house arrest, with two other suspects reportedly detained.
- Dodo said payment data is not stored and was not compromised, attackers’ access was blocked, an internal investigation is ongoing and Roskomnadzor was notified.