2026 Dodo Pizza — company confirms customer PII access; actor claims ~68M (count unverified)
Data compromised
Company: possible names, addresses, phones, emails, dates of birth, and order details for some customers; payment data not stored / not compromised. Actor DataSuckers claims ~68 million customers across countries plus ~15 years of order history and offered a sale — count and sale claims unverified; company did not publish a census. recordsAffected 0.
Technical writeup
Verified company notice — Dodo Pizza (Dodo Brands) stated on Sep 29, 2026 that attackers hit IT systems over Sep 27–28, may have accessed some customers’ names, addresses, phones, emails, DOBs, and order details, do not store payment data, notified Roskomnadzor, blocked attacker access, and are investigating. Hacking group DataSuckers claimed responsibility and advertised ~68 million customer records / 15 years of order history for sale (~$100k) — those figures and sale claims are unverified; Dodo did not confirm a headcount. recordsAffected 0; companyConfirmed true.
Root cause
Unauthorized access to IT systems Sep 27–28, 2026 (Dodo Pizza Telegram notice); access later blocked. DataSuckers claimed a vulnerability-led compromise.
References
- https://t.me/dodorus/511
- https://therecord.media/russian-pizza-chain-dodo-confirms-data-breach
- https://meduza.io/en/news/2026/09/29/russian-pizza-chain-dodo-pizza-says-hackers-breached-its-systems-and-may-have-accessed-customer-data
- https://databreaches.net/2026/09/29/russian-pizza-restaurant-chain-confirms-cyberattack-hackers-claim-68-million-users-exposed/