How did exposed credentials lead to the Dodo Pizza data breach?

The short version

• Russian authorities have detained three suspects linked to the DataSuckers hacking group.
• The breach of Dodo Pizza began with corporate credentials found on GitHub.
• Stolen data included personal details and order history from hundreds of millions of transactions.

The details

A Moscow court placed nineteen-year-old Denis Fridman under house arrest until eight December in connection with the Dodo Pizza incident, according to reports. He faces charges related to the illegal handling of computer information containing personal data. Two other suspects have also been detained, while a fourth remains at large. The group, known as DataSuckers, is financially motivated and has claimed responsibility for recent attacks on major businesses in Russia and Ukraine.

According to the Telegram outlet Baza, police identified the hackers after Fridman accidentally exposed his IP address while accessing the stolen data. This allowed authorities to trace him to his home in Barnaul. The suspects reportedly include citizens of Russia, Kazakhstan and Belarus. The Record could not independently verify the circumstances that led to the arrests.

The context

The attack reportedly started when hackers discovered Dodo Pizza corporate credentials exposed on GitHub. Using these credentials, they allegedly gained access to interconnected company systems, including cloud storage, databases and stored passwords. Dodo Pizza operates approximately 1,500 restaurants across 28 countries and previously acknowledged that attackers may have accessed customer information. This included names, addresses, phone numbers, email addresses, dates of birth and order details.

Kommersant reported that the stolen database was offered for sale on the dark web. The hackers reportedly received one hundred thousand dollars for the archive, with funds transferred to a shared cryptocurrency wallet. The wallet password was changed after Fridman’s arrest. DataSuckers also claimed responsibility for breaching Russian tour operator Tez Tour in September, stating they spent about two weeks inside the company’s systems.

Next steps

• Monitor dark web forums for mentions of Dodo Pizza or similar hospitality sector data.
• Review GitHub repositories and other code hosting platforms for accidentally exposed credentials.
• Audit access controls for cloud storage and databases linked to corporate accounts.
• Verify if any shared cryptocurrency wallets used by threat actors have been compromised.

What defenders should look for

Teams usually detect this type of activity by monitoring for unusual access patterns to cloud storage and databases. Check whether standard corporate credentials are being used from unexpected locations or at odd times. Look for alerts indicating large data exfiltration or new administrative privileges being granted. If suspicious activity is found, immediate containment moves include revoking the compromised credentials and isolating affected systems. Review logs for any lateral movement between interconnected services to ensure the breach is fully contained.

Background: Threat actors

Threat actors are individuals or groups who initiate cyber attacks. They range from lone hackers to state-sponsored organisations. Understanding their motives helps you predict behaviour. You must monitor for anomalies, not just known signatures, to detect their presence before data exfiltration occurs.

Read the full guide: What Is Threat Actors: Definitions, Tactics and Detection Strategies

What to do and how to stay safe: DataSuckers

• Audit all code repositories and public-facing systems for accidentally exposed credentials or sensitive data.
• Implement strict access controls and multi-factor authentication for all corporate accounts and cloud storage.
• Monitor network traffic for unusual data transfers or connections to known malicious IP addresses.
• Once the vendor provides an update, apply patches to any systems that may have been accessed by the attackers.

Step-by-step guide: Password Manager Security Checklist: Hardening Your Vault

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who are the suspects in the Dodo Pizza breach?

Russian authorities have detained three suspected members of the DataSuckers hacking group, including Denis Fridman.

How did the attackers gain access to Dodo Pizza systems?

They reportedly used corporate credentials that were exposed on GitHub to access interconnected systems.

What data was stolen in the breach?

The breach involved the theft of records related to hundreds of millions of orders, including personal customer information.