A cyberattack on the IT system of Dodo Pizza in Russia did not affect customer data from Kazakhstan. This was reported by the company's support service. At the same time, an investigation into the consequences of the attack is ongoing, and information about the possible leak of Russian users' data remains the subject of an investigation.
WHY KAZAKH CUSTOMERS' DATA WAS NOT AFFECTED
According to the support service of Dodo Pizza, the company's customer databases are distributed by country and stored separately. The cyberattack affected the IT system of the Russian division, so the information of Kazakh users was not affected.
The company previously reported that attackers may have gained access to the personal data of some customers. This concerns names, addresses, phone numbers, email addresses, dates of birth and order contents.
WHAT IS KNOWN ABOUT THE SCALE OF THE CYBERATTACK
According to the company's statement, the cyberattack occurred on 27–28 September 2026. Dodo Pizza reported the incident to Roskomnadzor and blocked the attackers' access. An internal investigation is ongoing.
Responsibility for the attack was claimed by the hacker group DataSuckers. According to its claim, the attackers gained access to several terabytes of information — they obtained a database with records on 68 million customers from various countries. In addition, the group claims to have 65 million unique phone numbers.
DataSuckers claims it obtained customers' full names, email addresses, phone numbers, dates of birth and home addresses. According to the attackers, the dump also included order history for all 15 years of the chain's operation, including the contents and cost of purchases.
The group also provides its own calculations of the database contents. According to its data, 53.1 million customers had placed an order at least once, while around another 15.2 million registered but did not make any purchases.
The total number of orders in the databases, according to the hackers' estimate, is 860–870 million. Of these, around 744 million, or 86%, are in Russia.
WHICH DATA IS AT RISK
According to the company's statement, personal information and order information of some customers are at risk. At the same time, payment data was not affected, since Dodo Pizza does not store it in its systems.
After the attack, the company also warned that users may be automatically logged out of their accounts. This is due to additional security measures.
Dodo Pizza said it is continuing its internal investigation and taking measures to prevent repeat incidents.
CONTEXT
In September 2026, the DataSuckers group also claimed to have hacked the tour operator Tez Tour. According to its claim, the attackers gained access to hundreds of millions of records and also deleted backups. The company confirmed a cyberattack on its website, but stated that it had found no signs of compromise of tourists' and partners' data.
