Loading story…
Russian pizza chain Dodo Pizza, which operates roughly 1,500 locations, confirmed that attackers breached its IT systems and may have accessed customer names, contact details, dates of birth, and order information. The company said payment-card data was not affected because it does not retain customers’ payment information. It blocked the attackers’ access, launched an internal investigation, and notified Russia’s data-protection regulator, Roskomnadzor.
A group calling itself DataSuckers claimed responsibility, alleging it stole records belonging to 68 million customers and 15 years of order history. The group reportedly offered the purported database for sale and threatened a partial publication, stating a financial rather than political motive. Dodo Pizza has not confirmed the claimed volume, and the scope and authenticity of the allegedly stolen data remain independently unverified.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
The group calling itself DataSuckers claimed responsibility for accessing Dodo Pizza databases, alleging it stole records for 68 million customers and 15 years of order history. It offered the purported database for about $100,000 and threatened to publish some data; the scope and authenticity of these claims were not independently verified.
Dodo Pizza disclosed that hackers breached its IT systems and may have accessed customer names, addresses, email addresses, phone numbers, dates of birth, and order details. The company said payment information was unaffected because it does not store payment data; it blocked attacker access, opened an internal investigation, and notified Roskomnadzor.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Turkish restaurant chain **Baydöner** suffered a data breach that exposed customer information and was later advertised on a public hacking forum. Reporting on the incident said the breach affected up to **3.7 million customer records**, while breach-tracking data identified more than **1.2 million unique email addresses** in the exposed dataset. The compromised information included names, email addresses, phone numbers, cities of residence, and **plaintext passwords**. A smaller subset of records also contained Turkish national ID numbers and dates of birth. Baydöner said in its disclosure notice that **payment and financial data were not impacted** by the incident.
Jun 29, 2026
Dutch authorities reported a prolonged compromise at the Dutch prisons agency **DJI**, where attackers reportedly maintained access for at least **five months**. Exposed information included staff **email addresses, phone numbers, and security certificates**, and the Dutch NCSC indicated the intruders also accessed **phones, tablets, and laptops**, though the extent of data access on those endpoints was not confirmed; DJI did not confirm whether access had been fully removed. Separately, Dutch telecom **Odido** disclosed a **data breach followed by an extortion attempt**, after which attackers publicly released about **1M records** (including **317k unique email addresses**) and threatened additional leaks. The published data reportedly included **names, physical addresses, phone numbers, bank account numbers**, and customer-service notes; Odido’s notice also warned that **dates of birth** and government ID numbers (passport/driver’s license) were impacted. A **Canadian Tire** breach entry describes a different incident in Canada (October 2025) involving ~**42M records** with PBKDF2-hashed passwords and some partial payment-card metadata, and is not part of the Netherlands-focused events above.
Jun 29, 2026
Panera Bread is facing renewed scrutiny after reports said a customer data breach was far larger than initially understood, with more than **5 million** people allegedly affected. The incident was linked to claims by the **ShinyHunters** extortion group, which said it had stolen Panera Bread data and was offering it for sale. Reporting indicated the exposed information included customer records and other personal details, raising concerns that the breach extended well beyond earlier public estimates. The disclosures follow a broader pattern of large-scale consumer data theft from online retail and shopping platforms. In a separate case, PandaBuy disclosed a breach tied to alleged exploitation of multiple API vulnerabilities, with independent validation indicating about **1.35 million** user accounts were compromised even as attackers claimed a larger haul. The stolen PandaBuy data reportedly included names, phone numbers, email addresses, login IPs, order details, and home addresses, underscoring the risk that attackers are targeting ecommerce platforms for rich stores of customer information that can be monetized or reused in follow-on fraud.
Jun 29, 2026