Russian police detain suspected DataSuckers hackers after Dodo Pizza breach

Russian authorities have reportedly detained three suspected members of DataSuckers, a financially motivated hacking group linked to the breach of pizza chain Dodo Pizza and to attacks on companies in Russia and Ukraine, The Record reported on October 16. The arrests are the first known law enforcement action against the group, which had publicly advertised its intrusions on Telegram.

What happened

According to The Record, which cited Russian outlets Kommersant and Baza and a Moscow court's Telegram post, a Moscow court on Wednesday placed 19-year-old Denis Fridman under house arrest until December 8. He faces charges related to the illegal handling of computer information containing personal data.

Fridman is reportedly one of four alleged members of the group. Two others have been detained and a fourth remains at large, the reports said, adding that the suspects are citizens of Russia, Kazakhstan and Belarus. Baza claimed that Fridman accidentally exposed his IP address while accessing the stolen Dodo Pizza data, which led police to his home in Barnaul. The Record noted that it could not independently verify how law enforcement located the suspects.

The Dodo Pizza breach

Dodo Pizza operates about 1,500 restaurants in 28 countries. According to The Record's reporting, the attackers found the company's corporate credentials exposed on GitHub and used them to access interconnected systems, including cloud storage, databases and stored passwords. The breach reportedly involved records tied to hundreds of millions of orders placed over 15 years. Dodo Pizza has acknowledged that names, addresses, phone numbers, email addresses, dates of birth and order details may have been accessed.

Kommersant reported that the database was offered for sale on the dark web for $100,000, with payment going to a shared cryptocurrency wallet whose password was reportedly changed after Fridman's arrest.

Other attacks attributed to the group

The Record said DataSuckers claimed to have spent about two weeks inside the systems of Russian tour operator Tez Tour in September and defaced its website. Tez Tour acknowledged the disruption but disputed that customer data was compromised, saying it isolated internal systems in time. Kommersant reported that Fridman took part in that attack and had previously targeted Ukrainian websites.

In early October, the group demanded $400,000 from ATB, Ukraine's largest grocery chain, and posted an extortion message with a countdown timer on its website. DataSuckers claimed to hold records on 7.9 million customers, employee passport information and more than 11 million order records. ATB denied that customer data was compromised, and the claims remain unverified.

The group describes itself as financially motivated rather than politically aligned. Last weekend, it said it would reduce its public activity and has not posted on Telegram since, according to The Record.

What to do

Dodo Pizza customers should be wary of phishing messages that reference past orders or personal details and change any reused passwords. For organizations, the reported entry point is a reminder to scan code repositories for exposed credentials and rotate any secrets found.