Dodo Pizza has confirmed that attackers breached its IT systems and may have accessed customers' names, addresses, email addresses, phone numbers, dates of birth and order details. The company confirmed it after a group calling itself DataSuckers took credit on Telegram. Dodo says it does not store payment data, so payment information is safe. It has blocked the attackers' access, notified the Russian regulator Roskomnadzor and started an internal investigation. The company has not said how many customers were affected. The attackers claim they took 2 to 3 TB of data covering about 68 million customers and 15 years of orders. Nobody has independently verified those figures. Reports of the chain's size also differ. The Record puts it at around 1,500 restaurants in 28 countries. Meduza says it has more than 1,527 pizzerias in Russia and 27 other countries. Pravda counts over 1,300 pizzerias and coffee shops across 26 countries for the parent company, Dodo Brands.
What Happened
Dodo Pizza posted its statement on its official Telegram and VKontakte channels. It said that "yesterday and today there was a cyberattack on our IT system." Meduza dates the attack to September 27 and 28. Kapital.kz reads "today" as September 28. As part of its response, the company forced customers to log out of their accounts and told them not to worry if this happened.
According to Xakep, DataSuckers posted on its Telegram channel overnight into September 28 that it was downloading a multi-terabyte database from "a popular fast-food delivery service." It later named Dodo Pizza. The Record reports that DataSuckers plans to publish part of the data and has offered to sell the full database for about $100,000. The group says it is financially motivated, not political. SecPost refers to its members as "hacktivists," so the label is used inconsistently. SecPost also reports that the group said Dodo was not the largest database it had taken and that more attacks were planned.
DataSuckers has claimed other recent intrusions. In September 2026 it said it had breached Russian tour operator Tez Tour. According to SecPost and RBC Life, it claimed 395 to 395.5 million records from that attack, which it said were sold to a "probiv" lookup bot. SecPost also reports that Dodo's Belarusian franchise, Pizza Star LLC, suffered a separate data leak in May 2026. That company admitted the leak, which exposed full names, delivery addresses, phone numbers and registration dates. The hackers' comments suggest they see the two incidents as different, saying the earlier breach "only extended to the Belarusian restaurant network."
What Was Taken
What the company confirmed: Dodo says the following data for "some" customers may have been exposed: names, addresses, email addresses, phone numbers, dates of birth, and order contents. It says it does not store payment data. SecPost notes that Dodo's privacy policy also covers geolocation data when customers allow it. The company did not say whether any geolocation data was exposed.
What the attackers claim: None of the following has been verified. - Volume: 2 to 3 TB of data (reported by SecPost, RBC Life and infohub.kz). - Customers: about 68 million records across all countries where Dodo operates, including 65 million unique phone numbers (RBC Life, Xakep). - Order history: Baza, as cited by Kapital.kz and Meduza, and Xakep report the claimed breakdown: 53.1 million customers placed at least one order and 15.2 million placed none. The database allegedly holds 860 to 870 million orders, including 744 million from Russia, covering the company's 15-year history with order contents and prices. - Geography: the group says most of the data belongs to Russian customers but that every market is affected. Kapital.kz and infohub.kz say there is no confirmation yet that Kazakh customers were affected.
Why the claim should be treated with caution: In April 2026, Dodo Brands said its app had 9 million monthly users in 26 countries (SecPost). A lifetime total of 68 million accounts over 15 years is not impossible, but it is far larger than that figure. Security Lab, cited by RBC Life, warns that the group's figures should not be treated as the confirmed size of the leak.
Why It Matters
Even without card data, this is a very useful dataset for fraud. It links a verified phone number, a home address, a date of birth and a detailed order history for each person. That is enough for convincing phishing and vishing. For example, a scammer can mention a real recent order, a real delivery address or a birthday discount. Kazakhstan's Blue Screen service has already told Dodo customers to be wary of calls, emails and messages that appear to come from the company, and never to share SMS codes or card details. Russian "probiv" lookup services add to the risk. DataSuckers has already sold data to one of these bots, and they combine leaked datasets into searchable identity profiles.
For defenders, the bigger lesson is scale. A single weakness in a consumer platform can expose customers in dozens of countries, across franchise and legal entities. Dodo Brands' parent company moved its legal domicile to the Astana International Financial Centre in 2025. That means cross-border regulators and notification duties may apply as well as Roskomnadzor.
The Attack Technique
Dodo has not disclosed how the attackers got in. All technical detail so far comes from the attackers. - Timeline: Xakep reports the group says it started on September 26, had full database access by September 27, and took about three hours to download the data. - Entry point: The Record and SecPost report the group's claim that "one seemingly minor vulnerability" or "one small oversight" led to full compromise. The group said Dodo was better defended than Tez Tour. - AI assistance: RBC Life reports the group claims it used artificial intelligence to carry out the attack. There is no corroboration, and this should be treated as a self-promoting claim until evidence appears.
It has not been established whether the weakness was a web or API flaw, exposed credentials, or a misconfigured data store. What we do know is that several terabytes were downloaded in hours without being stopped, which points to weak monitoring of outbound data.
What Organizations Should Do
- Rate-limit and alert on bulk data access. Dumping terabytes of customer and order tables in three hours should set off alerts on database query volume, API pagination patterns and outbound traffic long before the download finishes.
- Hunt for the "minor" weakness. Audit internet-facing APIs for broken object-level authorization, exposed admin and debug endpoints, leaked service credentials in code repositories and CI pipelines, and over-privileged service accounts that can read whole customer databases.
- Split customer data by market and franchise. One compromise should not reach every country's records. Separate databases by region and limit which services can read cross-market data.
- Minimize and expire historical data. Keeping 15 years of order history with full PII greatly increases the damage from a breach. Apply retention limits, and archive or pseudonymize old orders.
- Prepare customers for phishing that uses real details. Tell customers exactly how you will and will not contact them. Invalidate sessions, as Dodo did. Watch for lookalike domains and SMS sender IDs that impersonate your brand.
- Track data-extortion Telegram channels. Groups like DataSuckers announce intrusions publicly, sometimes while the attack is still running. Monitoring those channels can give you early warning.
Sources: Russian pizza chain with 1,500 locations confirms cyberattack follo... | Dodo Pizza confirms cyberattack: data of 68 million customers at ri... | «Додо Пицца» сообщила о кибератаке. В Сеть попали имена и адреса кл... | Хакеры заявили о взломе «Додо-Пиццы»: были похищены до 3 ТБ данных | Додо Пицца сообщила о кибератаке и утечке данных - новости Kapital.kz | «Додо Пицца» пострадала от кибератаки. Хакеры утверждают, что похит... | Russian pizza restaurant chain confirms cyberattack: Hackers claim... | Russian pizza chain Dodo Pizza says hackers breached its systems an...