MeridianMeridian

DataSuckers Members Arrested After Dodo Pizza Breach Exposes Customer Data

Three alleged members of the DataSuckers group have been arrested in connection with the theft of customer records from Dodo Pizza, a chain operating 1,500 restaurants across 28 countries. The stolen files, covering hundreds of millions of orders over fifteen years, included names, addresses, phone numbers, emails, birth dates, and order details. Investigators traced one suspect, 19-year-old Denis Fridman, after he exposed his IP address while accessing the stolen data. The intrusion began with credentials found exposed on GitHub, allowing lateral movement into internal systems, cloud storage, and password repositories. The data was later offered for sale on the dark web for $100,000. DataSuckers has also claimed responsibility for intrusions at Tez Tour and ATB, though both companies disputed the extent of data theft.

ZATAZTranslated from French

Read at source

Three alleged members of the DataSuckers group have been arrested following the large-scale theft of customer data from Dodo Pizza. A fourth suspect remains at large. The arrests mark a significant development in the investigation into the group, which claims financial motives and has targeted companies in Russia and Ukraine.

According to reports from Kommersant and Baza, the breach began when attackers discovered professional credentials exposed on GitHub. These credentials enabled initial access to interconnected internal systems, cloud storage environments, and databases. Attackers then extracted passwords stored within the compromised infrastructure. The stolen files, encompassing hundreds of millions of orders accumulated over fifteen years, were subsequently offered for sale on the dark web for $100,000.

In Moscow, a court placed 19-year-old Denis Fridman under house arrest until December 8. He faces charges related to the illegal handling of computer information containing personal data. Two other suspects, reportedly Russian, Kazakhstani, and Belarusian nationals, have also been detained, while one individual remains wanted. Investigators linked Fridman to the crime after he exposed his IP address while reviewing the stolen Dodo Pizza data from his residence in Barnaul.

Dodo Pizza confirmed that names, addresses, phone numbers, emails, birth dates, and order details may have been accessed. The group has also claimed responsibility for other incidents, including an intrusion at travel company Tez Tour and Ukrainian retailer ATB. Both companies acknowledged service disruptions but disputed claims of customer data theft.

Dodo PizzaDenis FridmanDataSuckersTez TourATB
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Breaches & Leaks

Railway Discloses Security Incident Potentially Exposing Encrypted Environment Variables Across 100,000 Workspaces
Breaches & Leaks

Railway Discloses Security Incident Potentially Exposing Encrypted Environment Variables Across 100,000 Workspaces

Railway reported a security incident detected on October 20, 2026, involving unauthorized access to systems storing customer environment variables. Attackers may have obtained both encrypted variables and, in some cases, their decrypted contents, which often include API keys, database credentials, and authentication tokens. The company estimated that up to 100,000 workspaces, representing 1.85% of the platform total, could have been affected. The probable objective was theft of API keys belonging to AI service providers. Railway collaborated with external vendors including GitHub, GitLab, Anthropic, OpenAI, and Stripe to proactively revoke potentially compromised keys. No user accounts were accessed, though source code exposure could not be ruled out. Deployments were paused during the investigation and later restored, with customers advised to rotate credentials and review logs.

ekurakNov 6, 2026Translated from Polish

Unauthorized Access to @cosme Exposes Partial Data of Approximately 3 Million Users
Breaches & Leaks

Unauthorized Access to @cosme Exposes Partial Data of Approximately 3 Million Users

Istyle Inc. announced on November 2 that unauthorized access to its @cosme platform had occurred, with confirmation of the data leak received on October 28. Partial member information belonging to roughly 3 million users registered under the @cosme common ID was exposed to external parties. The compromised data fields include user IDs, nicknames, full names in both kanji and kana, postal codes, addresses, telephone numbers, email addresses, gender, dates of birth, skin type, and hair type. Istyle is contacting all affected customers individually through known contact channels, with the process expected to conclude by November 6. The company has engaged a third-party security firm to determine the root cause and full scope of the incident while implementing measures to limit further damage. Future remediation steps will be developed based on the findings of the external investigation.

ScanNetSecurityNov 5, 2026Translated from Japanese

MUJI App Unauthorized Access Exposes Customer Data and Potential Credit Card Information
Breaches & Leaks

MUJI App Unauthorized Access Exposes Customer Data and Potential Credit Card Information

Ryohin Keikaku Co., Ltd. has issued a second report on the unauthorized access to its MUJI App that was first disclosed on October 30. The breach initially involved customer email addresses, dates of birth, and gender, but further investigation revealed that names, addresses, and phone numbers were also exposed for some users of both the MUJI App and the Muji online store. Credit card details linked to the MUJI Card issued by Credit Saison, as well as partial card information registered directly in the app or store, may have been accessed by external parties. Approximately 27.26 million records containing basic personal data are affected, with 520,000 of those also including full address and phone details. In addition, full credit card numbers, MUJI Card IDs, and birth dates for about 1.09 million MUJI Card members who joined before July 2021 are potentially compromised, of which 345,000 cards remain valid. The company has blocked further unauthorized access and is monitoring its systems while notifying affected customers individually by email or mail.

ScanNetSecurityNov 5, 2026Translated from Japanese