Russian food chain Dodo Pizza hit by cyberattack, customer data stolen

Dodo Pizza, a Russian food chain, has disclosed a cybersecurity incident involving unauthorised access to its internal network and the theft of sensitive customer data.

 

Dodo Pizza is a global fast-food and pizza restaurant brand established in Russia in 2011. It has more than 1,500 outlets across nearly 30 countries, with a presence in Europe, Asia, the Middle East, and Africa.

 

Dodo Pizza recently reported that it detected unauthorised activity within part of its internal network on September 28, which continued through September 29. The company immediately launched an investigation, with assistance from external cyber security experts, to determine the scope of the incident.

 

“A cyberattack on our IT system occurred yesterday and today. Our information security team is doing everything possible to prevent this from happening again. In the meantime, we want to be transparent about the data belonging to some of our customers that may have been exposed,” Dodo Pizza said.

 

The compromised data included names, addresses, email addresses, phone numbers, dates of birth, and order details. The company assured customers that it does not retain payment details and that their data remains protected.

 

Dodo Pizza said it has reported the incident to Roskomnadzor, Russia’s federal regulator overseeing communications, media, information technology, and data-protection compliance, and is cooperating with the agency as it investigates the breach.

 

“Access for the attackers has been blocked, and an internal investigation is underway. If you find yourself logged out, please do not worry; this is one of the measures we are taking to protect accounts,” the company added.

 

On September 29, a threat actor operating under the alias “DATASUCKERS” claimed responsibility for the cyberattack on Dodo Pizza, listing the company as a victim on the dark web. 

 

 

 

The threat actor claimed to have obtained 68 million customer records, including names, email addresses, physical addresses, and order histories, as well as more than 3 TB of data. DataSuckers said it planned to publish part of the stolen information and was offering the complete database for sale for approximately $100,000.