Domino’s customers targeted in credential stuffing attacks
Domino's reset a small number of UK accounts after credential-stuffing logins that used reused passwords.
Domino's Pizza emailed some customers to say an unauthorized party accessed their accounts with email and password pairs stolen in earlier, unrelated breaches. The company said its own systems were not breached, it does not store payment details, and only a very small number of accounts were affected. Domino's reset those accounts, told customers to choose a new unique password, and reported the incident to the UK Information Commissioner's Office. Malwarebytes explained that stuffing succeeds because people reuse passwords, and that working logins can later be used for orders, loyalty balances, or resale.
43