Moscow Police Arrest Suspected DataSuckers Hackers Linked to Major Data Breaches

Who are the DataSuckers and what happened?

According to Recorded Future News↗ (opens in a new tab), Moscow police have detained three people suspected of being part of the DataSuckers hacking group. The arrests follow a cyberattack on Dodo Pizza, a large fast-food chain with 1,500 restaurants in 28 countries. The attack reportedly exposed customer data from hundreds of millions of orders over 15 years. One suspect, Denis Fridman, has been placed under house arrest. Two others are also in custody, while a fourth is still at large. The suspects are said to be citizens of Russia, Kazakhstan, and Belarus.

How did the Dodo Pizza breach happen?

The hackers are believed to have found Dodo Pizza's corporate login details on GitHub, a public code-sharing website. Using these credentials, they allegedly accessed the company's internal systems, including cloud storage and databases. This gave them access to customer information such as names, addresses, phone numbers, email addresses, dates of birth, and order details. Police reportedly identified one suspect after he exposed his own IP address while viewing stolen data, allowing them to trace him to his home.

What did the hackers do with the stolen data?

Kommersant, a Russian newspaper, reported that the stolen database was put up for sale on the dark web. The hackers are said to have received $100,000 for the data, paid into a shared cryptocurrency wallet. After one suspect was arrested, the password to the wallet was changed. Dodo Pizza has confirmed that attackers may have accessed customer data, but the full extent of the breach is still unclear.

Other attacks linked to DataSuckers

DataSuckers has claimed responsibility for attacks on other major businesses in Russia and Ukraine. In September, they said they breached Russian tour operator Tez Tour, spending two weeks inside its systems. Tez Tour admitted its website was defaced but denied that customer data was stolen, saying it had isolated its systems in time. The group also claimed an attack on ATB, Ukraine's largest grocery chain, demanding $400,000 and threatening to leak data from millions of customers. ATB denied any customer data was compromised, though the hackers claimed to have names, contact details, and order records for millions of people. These claims have not been independently verified.

What happens next?

The investigation is ongoing. Russian authorities have charged at least one suspect with illegal handling of computer information containing personal data. DataSuckers has said it will continue its activities but with less public messaging. The group uses a Telegram channel to announce attacks and communicate with victims. It describes itself as financially motivated, not politically aligned.

What should affected customers do?

If you have ordered from Dodo Pizza or other companies mentioned, watch for any official notifications. Be cautious of phishing emails or scams using your personal information. Change your passwords if you use the same ones elsewhere. Monitor your accounts for suspicious activity.

What is still unclear?

Most details come from a single news outlet and have not been confirmed by Russian authorities or the affected companies. The exact number of people affected and the full scope of the breaches remain unknown. Some companies have denied that customer data was compromised, while the hackers claim otherwise.