The Record reported that Russian authorities have detained three suspected members of DataSuckers, a hacking group that calls itself financially motivated. On Wednesday, a Moscow court put 19-year-old Denis Fridman under house arrest until December 8. The case concerns the Dodo Pizza breach, which reportedly took records of hundreds of millions of orders from 15 years. Kommersant and Baza said the group has four alleged members. Two others are held, and one is still free.
Much of this is unverified. Recorded Future News could not confirm how police found the suspects. The Record reported that the attack began with Dodo Pizza's corporate credentials, exposed on GitHub, a site for sharing code. The attackers allegedly used them to reach linked cloud storage, databases and stored passwords. Dodo Pizza said attackers may have seen customer names, contact details, birth dates and order details. The sources do not say how the credentials reached GitHub.
If the reports are right, one leaked credential worked like a master key. A credential is a login that software uses instead of a person. Anyone who copies it gets the same access. When systems trust each other, that access spreads. Teams can check whether code is scanned for secrets, how fast leaked ones are replaced, whether each credential is limited to one job, and whether storage, databases and passwords sit apart.