Exposed Credentials on GitHub Allegedly Led to Dodo Pizza Breach and Arrests in Moscow

Russian authorities have reportedly detained three suspected members of the DataSuckers hacking group after a cyberattack on restaurant chain Dodo Pizza. A Moscow court placed 19-year-old Denis Fridman under house arrest until December 8 over the breach, which reportedly involved records of hundreds of millions of orders placed over 15 years. A fourth alleged member remains at large. The suspects reportedly include citizens of Russia, Kazakhstan and Belarus.

According to reports, the attack began when the hackers found Dodo Pizza's corporate credentials exposed on GitHub. They allegedly used those credentials to reach interconnected company systems, including cloud storage, databases and stored passwords. Dodo Pizza has acknowledged that attackers may have accessed names, addresses, phone numbers, email addresses, dates of birth and order details. Kommersant reported that the stolen database was offered for sale on the dark web and that the group received $100,000 for it.

Baza reported that police identified Fridman after he accidentally exposed his IP address while accessing the stolen data. Recorded Future News could not independently verify how law enforcement found the suspects. DataSuckers has emerged in recent months and has claimed attacks on major businesses in Russia and Ukraine, including tour operator Tez Tour in September.