- Russian authorities reportedly detained three suspected DataSuckers members over the Dodo Pizza breach, which reportedly began with corporate credentials exposed on GitHub.
- The attackers allegedly reached several connected systems, including cloud storage, databases and stored passwords. The reports do not say in what order or by what path.
- Leaders should ask how far one leaked credential could reach in their own systems, and how fast they could revoke it.
Breach coverage often focuses on how it started. A better question is how far it could reach. The Dodo Pizza case, as reported, shows why that question matters.
The Record, part of Recorded Future News, reports that Russian authorities have detained three suspected members of a hacking group called DataSuckers. A fourth suspect is reportedly still free. On Wednesday, a Moscow court ordered 19-year-old Denis Fridman to stay at home under court supervision through December 8. The charges relate to mishandling digital records that hold personal details.
The report draws on the Russian newspaper Kommersant and the Telegram news outlet Baza. The Record says it could not independently verify how police found the suspects. Everything below about the breach is reported or alleged, not proven in court.
What the reports say happened
According to Baza, the attack began when the hackers found Dodo Pizza's corporate credentials exposed on GitHub. GitHub is a service where developers store and share code. The report does not say how the credentials got there.
Credentials are the usernames, passwords or keys that prove who you are to a system. With them, the attackers allegedly reached several connected company systems. These included cloud storage, databases and stored passwords.
The report does not say in what order they reached these systems. It does not say which credential opened which system. Those details are unknown.
Dodo Pizza earlier said intruders may have seen customer records. The exposed details could include contact information, birth dates and what people ordered. The company runs about 1,500 restaurants in 28 countries.
What this suggests about reach
The facts are limited. Credentials were reportedly exposed, and several systems were reportedly reached. Here is our interpretation of that, not a finding about Dodo Pizza.
If the reports are accurate, the breach's reach suggests a wider question. A leaked key matters most when many systems accept it. The size of a breach may be set long before an attack, by how widely access is shared.
A password store is a useful example of this general point. Stored passwords can open other doors. That is background for your own planning. The reports do not say how the attackers used them.
Caught by a small slip
Baza reports that police found Fridman after he accidentally revealed his IP address. He was viewing the stolen data at the time. An IP address is the network address a device shows to the sites it visits. It led police to his home in Barnaul.
That is good news for investigators. It is not a security plan for a company. Kommersant reports the hackers were paid $100,000 for the archive. The money went to a shared cryptocurrency wallet. Its password was reportedly changed after Fridman's arrest.
A group with several claims, and several denials
DataSuckers calls itself financially motivated, not political. It announces attacks on a public Telegram channel. The Record lists other claims, and some are disputed.
In September, the group claimed it breached the Russian tour operator Tez Tour. Tez Tour confirmed the disruption but disputed that customer data was taken. It said it had walled off its internal systems before the attackers reached them.
This month, the group claimed an attack on ATB, Ukraine's largest grocery chain. It demanded $400,000. It said it held records on 7.9 million customers. Those claims are unverified. ATB denied that customer data was compromised. It said it took some online services offline for technical maintenance.
These are different companies with different facts. The Record does not link them to one cause.
Questions for your security team
The source does not describe Dodo Pizza's internal setup. So these questions are about your own systems.
First, can we find every credential in our code repositories? That includes old versions and contractor accounts. Second, if one login leaked today, which systems could it reach? Third, do our cloud storage, databases and password stores share access, or are they kept apart? Fourth, how long would it take to revoke a leaked credential everywhere it is used?
Put the second question on a board agenda. A leak is a mistake. How far a leak can travel is something a company can decide in advance.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Record.
