// AI threat desk · 17 Oct 2026
Home/LEAK · Data Leaks
Data LeaksMediumDATACVSS not assigned

Dodo Pizza attack leads to detention of three suspected DataSuckers

Three suspected DataSuckers members were detained after a cyberattack on Dodo Pizza exposed customer information, The Record reported.

· 3 min read
AI-generated image of analysts reviewing a cyberattack investigation in a security operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • The Record said three suspected DataSuckers members were detained after the Dodo Pizza cyberattack.
  • The Record said Denis Fridman was placed under house arrest until Dec 8 over the breach.
  • Russian media reports said a fourth alleged DataSuckers member remains at large.

Russian authorities reportedly detained three suspected members of the DataSuckers hacking group after a cyberattack on Dodo Pizza exposed customer information, The Record said. A Moscow court placed 19-year-old Denis Fridman under house arrest until Dec 8 in connection with the breach, it said.

The incident reportedly involved records related to hundreds of millions of orders placed over 15 years. Dodo Pizza previously acknowledged that attackers may have accessed customer names, addresses, phone numbers, email addresses, dates of birth and order details.

Dodo Pizza is a Russian fast-food chain operating approximately 1,500 restaurants across 28 countries. The Record said the suspected hackers reportedly include citizens of Russia, Kazakhstan and Belarus.

On this page

Exposed GitHub credentials reportedly opened Dodo Pizza systems

The Record said the attack reportedly began when the hackers discovered Dodo Pizza corporate credentials exposed on GitHub. Using those credentials, the attackers allegedly accessed interconnected company systems, including cloud storage, databases and stored passwords.

Baza reported that police identified Fridman after he accidentally exposed his IP address while accessing data from Dodo Pizza.

Kommersant reported that the database was offered for sale on the dark web and that the hackers received $100,000 for the archive. The money was reportedly transferred to a shared cryptocurrency wallet, whose password was changed after Fridman’s arrest.

DataSuckers claimed attacks on companies in Russia and Ukraine

The Record said DataSuckers has emerged in recent months, claiming responsibility for attacks on major businesses in Russia and Ukraine. The group describes itself as financially motivated rather than politically aligned and primarily communicates in Russian through a public Telegram channel.

In September, the group claimed responsibility for breaching Russian tour operator Tez Tour after spending about two weeks inside its systems. Tez Tour acknowledged disruption but disputed claims that customer data had been compromised, saying it isolated internal systems before attackers could access them.

Earlier this month, DataSuckers claimed responsibility for an attack on ATB and demanded $400,000 while threatening to publish data it claimed to have obtained from millions of customers. The group claimed to have obtained records belonging to 7.9 million ATB customers and more than 11 million order records, but those claims were not independently verified.

Two other suspects were detained while a fourth alleged DataSuckers member remains at large, according to Russian media reports. The Record said the circumstances that led Russian law enforcement to the suspects could not be independently verified by Recorded Future News.

DataSuckers said it was operating as usual but that less public activity from the group would be seen.

FAQ

What happened in the Dodo Pizza cyberattack?

The Record said a cyberattack on Dodo Pizza exposed customer information and involved records related to hundreds of millions of orders placed over 15 years.

Who was detained over the Dodo Pizza breach?

The Record said Russian authorities reportedly detained three suspected DataSuckers members and that a Moscow court placed 19-year-old Denis Fridman under house arrest until Dec 8. Russian media reports said a fourth alleged member remains at large.

What information may have been accessed from Dodo Pizza?

Dodo Pizza previously acknowledged that attackers may have accessed customer names, addresses, phone numbers, email addresses, dates of birth and order details.

How did the attackers reportedly access Dodo Pizza systems?

The Record said the attackers reportedly found Dodo Pizza corporate credentials exposed on GitHub and allegedly used them to access cloud storage, databases and stored passwords.

Sources

  1. Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia, The Record
  2. Russian police round up 60 demonstrators following authorized KPRF rally in Moscow - video, The New Voice of Ukraine
How we checked this story
ClaimSourceStatus
The Record said russian authorities reportedly detained three suspected members of the DataSuckers hacking group after a cyberattack on a popular restaurant chain exposed customer information.The RecordAttributed
The Record said a Moscow court placed 19-year-old Denis Fridman under house arrest until December 8 in connection with the Dodo Pizza breach.The RecordAttributed
The Dodo Pizza breach reportedly involved theft of records related to hundreds of millions of orders placed over 15 years.The RecordAttributed
The Record said fridman faces charges connected to the illegal handling of computer information containing personal data.The RecordAttributed
Two other suspects were detained while a fourth alleged DataSuckers member remains at large, according to Russian media reports.Russian, via The RecordAttributed
The Record said the suspected hackers reportedly include citizens of Russia, Kazakhstan and Belarus.The RecordAttributed
Baza reported that police traced Fridman after he accidentally exposed his IP address while accessing data stolen from Dodo Pizza.Baza, via The RecordAttributed
The Record said the attack reportedly began after the hackers found Dodo Pizza corporate credentials exposed on GitHub.The RecordAttributed
The Record said using those credentials, the attackers allegedly accessed interconnected company systems, including cloud storage, databases and stored passwords.The RecordAttributed
The Record said kommersant reported that the stolen database was offered for sale on the dark web and that the hackers received $100,000 for it.The RecordAttributed
The Record said the money was reportedly transferred to a shared cryptocurrency wallet, whose password was changed after Fridman’s arrest.The RecordAttributed
Recorded Future News could not independently verify the circumstances that led Russian law enforcement to the suspects.The RecordAttributed
The Record said dodo Pizza is a Russian fast-food chain operating approximately 1,500 restaurants across 28 countries.The RecordAttributed
Dodo Pizza previously acknowledged that attackers may have accessed customer names, addresses, phone numbers, email addresses, dates of birth and order details.Dodo Pizza, via The RecordAttributed
The Record said dataSuckers has emerged in recent months, claiming responsibility for attacks on major businesses in Russia and Ukraine.The RecordAttributed
The Record said in September, DataSuckers claimed responsibility for breaching Russian tour operator Tez Tour after spending about two weeks inside its systems.The RecordAttributed
Tez Tour acknowledged disruption but disputed claims that customer data had been compromised, saying it isolated internal systems before attackers could access them.Tez Tour, via The RecordAttributed
The Record said earlier this month, DataSuckers claimed responsibility for an attack on ATB and demanded $400,000 while threatening to publish data.The RecordAttributed
DataSuckers claimed to have obtained records belonging to 7.9 million ATB customers and more than 11 million order records, but those claims were not independently verified.DataSuckers, via The RecordAttributed
The Record said dataSuckers describes itself as financially motivated rather than politically aligned and primarily communicates in Russian through a public Telegram channel.The RecordAttributed
DataSuckers said last weekend that it was continuing operations but would reduce its public activity.DataSuckers, via The RecordAttributed
The New Voice of Ukraine said a significant portion of detainees were held overnight in local police precincts pending expedited judicial hearings.The New Voice of UkraineAttributed
The New Voice of Ukraine said several demonstrators were reportedly placed under 48-hour administrative detention orders before their court appearances.The New Voice of UkraineAttributed
SOTAvision said police reportedly pressured several detainees into signing procedural documents retroactively labeling the authorized gathering as unsanctioned.SOTAvision, via The New Voice of UkraineAttributed
The New Voice of Ukraine said police began mass detentions after people in the crowd started chanting Down with the Czar.The New Voice of UkraineAttributed
The New Voice of Ukraine said demonstrators said police conduct was relatively calm during the initial gathering and that no direct physical altercations occurred.The New Voice of UkraineAttributed
The New Voice of Ukraine said independent observers and media estimated that several hundred to approximately 2,000 people attended the memorial rally.The New Voice of UkraineAttributed
The Record said a Moscow court placed Denis Fridman under house arrest until December 8 over the Dodo Pizza breach.The RecordAttributed

Could not verify

  • Recorded Future News could not independently verify the circumstances that led Russian law enforcement to the suspects.
See all in Data Leaks →
Explore with AI
ChatGPT
Claude
Perplexity
Grok