Russian pizza chain with 1,500 locations confirms cyberattack following hacker claims

Hackers breached the systems of popular Russian fast-food chain Dodo Pizza and gained access to some customers’ personal information, the company said Monday.

According to Dodo Pizza, the potentially compromised information included customers’ names, addresses, email addresses, phone numbers, dates of birth and order details. The company said it does not store customers’ payment information and that payment data was therefore not compromised.

“The attackers’ access has been blocked, and an internal investigation is ongoing,” Dodo Pizza said, adding that it had notified Russian communications regulator Roskomnadzor about the incident.

The company operates around 1,500 pizza restaurants across 28 countries. Its Russian business reported about $120 million in revenue this month, according to figures published on the company’s website.

A hacking group calling itself DataSuckers claimed responsibility for the attack, saying on its Telegram channel that it had gained access to Dodo Pizza’s databases.

The group claimed it obtained records belonging to 68 million customers across multiple countries, along with 15 years of order history. Those claims could not be independently verified, and Dodo Pizza did not say how many customers were affected.

DataSuckers said it planned to publish some of the data and offered to sell the database for about $100,000.

“Dodo is a good company. And the pizza there is really good. I’m not a Dodo hater or anything like that,” an administrator of the hackers’ Telegram channel said. “But Dodo had one seemingly minor vulnerability that ultimately led to a complete compromise.”

The group describes itself as financially rather than politically motivated and uses its Telegram channel to publish detailed accounts of its intrusions. It also openly invites victims, journalists and law enforcement agencies to contact it for comment or samples of allegedly stolen information.

Earlier this month, DataSuckers claimed responsibility for an attack on Tez Tour, one of Russia’s major tour operators, and defaced the company’s website.

The hackers said they had spent about two weeks inside Tez Tour’s systems and stolen customer information. A company representative confirmed that its website had been disrupted but did not admit that any data had been stolen.

DataSuckers subsequently published screenshots of folders it claimed belonged to Tez Tour and a sample of what it described as the company’s database. The group later claimed it sold the stolen data to a buyer for $10,000. Those claims have not been independently verified.