DataSuckers (Threat actor): news timeline & CVEs

Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia

Moscow police detained suspected DataSuckers hackers over the Dodo Pizza breach affecting hundreds of millions of orders.

Russian authorities detained three suspected members of the financially motivated DataSuckers group after a cyberattack on restaurant chain Dodo Pizza. A Moscow court placed 19-year-old Denis Fridman under house arrest until December 8 on charges of illegally handling computer information containing personal data. The breach reportedly involved records covering hundreds of millions of orders over 15 years. A fourth suspect remains at large, and the group has claimed attacks on businesses in Russia and Ukraine; suspects include citizens of Russia, Kazakhstan, and Belarus.

DataBreaches.netOct 16, 17:45 UTC · 11h agoPolicy & legal 2 sources

Moscow detains suspected DataSuckers hackers linked to breaches in Ukraine and Russia

Moscow placed a suspected DataSuckers member under house arrest over the Dodo Pizza customer-data breach.

Russian authorities detained three suspected members of the financially motivated DataSuckers group after a Dodo Pizza breach that reportedly exposed records tied to hundreds of millions of orders over 15 years. A Moscow court placed 19-year-old Denis Fridman under house arrest until December 8, while a fourth suspect remains at large. Investigators say the attackers used corporate credentials found on GitHub and later sold the database for $100,000. The group has also claimed attacks on Tez Tour and Ukraine’s ATB chain, including a $400,000 extortion demand; several data-theft claims remain disputed or unverified.

The Recordupdated Oct 16, 17:45 UTC · 11h agofirst Oct 16, 13:30 UTC · 15h agoPolicy & legal 2 sources

Risky Bulletin: Russia arrests DataSuckers hacking group

Russia arrested DataSuckers members accused of extortion hacks against Dodo Pizza, ATB Market, and Tez Tour.

Russian authorities arrested three members of DataSuckers, a data-extortion group they say has four members across Russia, Belarus, and Kazakhstan. Denis A. Friedman, 19, of Barnaul, was arraigned in Moscow, placed under house arrest until December 8, and faces up to six years. The group is linked to intrusions at Ukraine’s ATB Market, Tez Tour, and Dodo Pizza, using valid GitHub credentials, stealing data, destroying systems, and demanding ransoms. The same bulletin also reports Candiru spyware delivered through ads, a Fehmarn Belt tunnel-construction cyberattack, and US state lawsuits against OpenAI.

Risky Business NewsOct 16, 02:01 UTC · 1d agoPolicy & legal in the wild4

12th October – Threat Intelligence Report

Check Point's weekly report covers a Denmark registry breach of 8.8 million people, ransomware, and exploited enterprise flaws.

Check Point's 12 October threat bulletin leads with breaches and attacks: Denmark's Central Register of Persons exposure of about 8.8 million people via a supplier, credential theft at ASOS claimed by Xuanye, a DataSuckers extortion claim of 7.9 million ATB customer records, and a suspected ransomware attack on Osaka Metropolitan University affecting about 500 servers and possibly 130,000 people. Citrix confirmed targeted exploitation of NetScaler CVE-2026-88779, while critical patches cover Veeam CVE-2025-64393, Cisco NX-OS CVE-2026-76455, and Atlassian CVE-2026-21589. The bulletin also describes UAC-0099 espionage, ongoing FortiBleed credential theft on more than 86,000 Fortinet devices, and AI-assisted intrusions and phishing.

Check Point ResearchOct 12, 14:51 UTC · 4d agoData breach in the wildCVE-2025-64393 CVE-2026-88779 CVE-2026-76455+1 CVEs10· 4 reads

Ukraine grocery chain ATB confirms cyberattack as hackers threaten to leak data

Ukraine's ATB grocery chain confirmed a cyberattack after DataSuckers demanded $400,000 and threatened to leak customer data.

Ukraine's largest grocer, ATB, confirmed a cyberattack after DataSuckers posted a $400,000 extortion demand and countdown on its website. The group claimed records on 7.9 million customers, including names, phones, emails, addresses, password hashes, employee passport data, and more than 11 million orders, then posted samples on Telegram. ATB denied that customer data was compromised and said the site remained under its control; the claimed breach has not been independently verified. The financially motivated group has also claimed recent attacks on Russia's Dodo Pizza and Tez Tour.

The RecordOct 5, 17:00 UTC · 11d agoRansomware in the wild

Russian pizza restaurant chain confirms cyberattack: Hackers claim 68 million users exposed

Dodo Pizza confirmed a cyberattack that may have exposed customer data, while hackers claim 68 million users.

Dodo Pizza confirmed a cyberattack on its IT systems and said attackers may have accessed personal data for part of its customer base. Possible data includes full names, physical addresses, email addresses, phone numbers, dates of birth, and order history. The company reported the incident to Roskomnadzor and said access has been blocked. The group DATASUCKERS claims it stole 2–3 TB covering about 68 million customers, including in Kazakhstan, but those figures are unverified.

DataBreaches.netSep 29, 12:43 UTC · 17d agoData breach in the wild

Russian pizza chain with 1,500 locations confirms cyberattack following hacker claims

Dodo Pizza confirmed hackers accessed some customers' personal data after DataSuckers claimed 68 million records.

Russian fast-food chain Dodo Pizza confirmed attackers accessed some customers’ names, addresses, emails, phone numbers, dates of birth and order details, but said it does not store payment data. The company blocked the access, notified regulator Roskomnadzor and said an investigation is ongoing. Dodo operates about 1,500 restaurants in 28 countries. Group DataSuckers claimed 68 million records and 15 years of orders and offered the database for about $100,000; those figures were not confirmed. The group previously claimed a breach of tour operator Tez Tour.

The RecordSep 29, 12:34 UTC · 17d agoData breach in the wild

DataSuckers

Timeline7 articles

Related CVEsby mentions

Appears with