Russian authorities have detained three suspected members of the DataSuckers hacking group in connection with a cyberattack on Dodo Pizza, a popular restaurant chain. The breach reportedly exposed customer information from hundreds of millions of orders spanning 15 years. A Moscow court has placed 19-year-old Denis Fridman under house arrest until December 8, facing charges related to the illegal handling of personal data.
Fridman is one of four alleged members of DataSuckers, which has claimed responsibility for various attacks on major businesses in Russia and Ukraine. Two other suspects have been detained, while a fourth remains at large. Reports indicate that the suspects include citizens from Russia, Kazakhstan, and Belarus. Authorities identified Fridman after he inadvertently exposed his IP address while accessing the stolen data, leading to his traceable location in Barnaul, Russia.
Details of the Dodo Pizza Breach
The attack on Dodo Pizza reportedly began when the hackers discovered corporate credentials exposed on GitHub. Using these credentials, they gained access to interconnected company systems, including cloud storage and databases, as well as stored passwords. Following the breach, the stolen database was allegedly offered for sale on the dark web, with the hackers reportedly receiving $100,000 for the archive, which was transferred to a shared cryptocurrency wallet. Notably, the wallet’s password was changed after Fridman’s arrest.
Dodo Pizza, which operates approximately 1,500 restaurants across 28 countries, acknowledged that customer information—including names, addresses, phone numbers, email addresses, dates of birth, and order details—may have been accessed during the breach.
DataSuckers’ Broader Activities
DataSuckers has emerged as a significant threat in recent months, claiming responsibility for multiple attacks on businesses in both Russia and Ukraine. In September, the group breached Russian tour operator Tez Tour, claiming to have spent two weeks inside the company’s systems and obtained large amounts of customer information. Tez Tour acknowledged the disruption but disputed claims regarding the compromise of customer data, asserting that it had isolated its internal systems before the attackers could access sensitive information.
Fridman is alleged to have participated in that attack and has a history of targeting Ukrainian websites prior to joining DataSuckers. Earlier this month, the group also claimed responsibility for an attack on ATB, Ukraine’s largest grocery store chain, demanding a ransom of $400,000 and threatening to publish data it claimed to have stolen from millions of customers. ATB denied any compromise of customer information, stating that it had temporarily taken some online services offline for maintenance.
DataSuckers claims to have obtained records belonging to 7.9 million ATB customers, including names, contact information, addresses, and password hashes, along with employee passport information and over 11 million order records. These claims have not been independently verified.
The group describes itself as financially motivated rather than politically aligned and primarily communicates in Russian. It uses a public Telegram channel to announce attacks, publish details of alleged intrusions, and invite victims, journalists, and law enforcement agencies to contact its members. In a recent message, DataSuckers indicated that while it would reduce its public activity, it would continue its operations, focusing on specific targets.
As investigations continue, the implications of these arrests and the ongoing activities of DataSuckers highlight the persistent threat posed by financially motivated cybercriminals in the region.
For further details, see the report by The Record.
