Skip to content
Today
Sections

Security Reports disagree3 publishers 2 min read Published

Russia arrests three of four suspected DataSuckers members in the Dodo Pizza breach

Russian authorities have arrested three of the four suspected members of DataSuckers in the Dodo Pizza investigation, Risky.Biz and Nasha Niva report. Police tracked a 19-year-old from Barnaul through his home IP address, according to Risky.Biz.

The Watch · Security desk

Send a correction

Hackers sold Dodo Pizza's data, Baza says Experts' estimate of the data accessed, as Nasha Niva reports; what Baza says the hackers received for it; and the size of the Dodo Pizza chain.

Three figures: about 33 billion records, 3.7 TB covering 15 years, that experts estimate the attackers accessed, per Nasha Niva; $100,000 that Baza says the hackers received for the data; and more than 1,500 Dodo Pizza restaurants across 28 countries, unconfirmed.

Hackers sold Dodo Pizza's data, Baza says
FigureValueNoteClaim
Records accessed, about, experts' estimate33,000,000,000 records3.7 TB, covering 15 years16
Received for data, per Baza100,000 US dollars17
Dodo Pizza restaurants, more than1,500 restaurantsunconfirmed; across 28 countries10

What happened

  • Risky.Biz reported that Denis A. Friedman, the Barnaul suspect, is under house arrest for two months, until December 8.
  • Baza, a Telegram channel cited by Nasha Niva, dates the Dodo Pizza breach to September 28.
  • Nasha Niva reports an estimate from unnamed experts that the attackers accessed 3.7 TB, about 33 billion records covering 15 years of orders, customers, employees and delivery addresses.
  • Baza says the hackers put the stolen data up for sale on the dark web and received $100,000 for it.

Why it matters

  • Who's exposed exposure Belarusian customers are affected because franchise rules sent their data to the Russian company. Belarus's data protection center says names, addresses, emails, phone numbers, birth dates and order details could be compromised.
  • What doesn't add up contradiction Risky.Biz describes victims being threatened with the sale of their files, while the Dodo Pizza account Nasha Niva relays describes a sale that had already happened.
  • Who has to decide decision Teams that keep production credentials in GitHub face the same first step and must decide how quickly to scan for and rotate them.

Risky.Biz calls DataSuckers a Lapsus and ShinyHunters-like group operating across the former Soviet space [6]. Authorities say it has four members, spread across Russia, Belarus and Kazakhstan [1]. Baza, a Telegram channel whose reporting Nasha Niva relays, says the three detainees are citizens of those same three countries [4]. Friedman is the only suspect named, and Risky.Biz said no other details were provided on the other two [7]. He faces up to six years in prison if found guilty on the current charges [13].

DataSuckers started operating this year and has been linked to at least three major hacks: ATB Market, a Ukrainian supermarket chain, and Tez Tour and Dodo Pizza in Russia [8]. Russian authorities opened their investigation after the Dodo Pizza attack, Risky.Biz said. Dodo operates more than 1,500 restaurants in 28 countries [10]. Baza says the 19-year-old had earlier hacked Ukrainian websites before picking a larger target in Russia [11]. The sources give no account of how ATB Market or Tez Tour were breached.

Both accounts begin the Dodo Pizza intrusion with a GitHub credential, though they word it differently. Risky.Biz says DataSuckers reportedly found valid credentials in Dodo Pizza's GitHub accounts and used them to reach backend systems [2]. Baza says the logins were in open access on GitHub and opened internal systems, then cloud storage, databases and passwords [5].

The money trail comes from Baza alone. It says the buyer sent the whole sum to a crypto wallet that all four members could have used [18]. After the 19-year-old's arrest, the other three changed the passwords and locked him out [18]. Two more were then detained, and the one suspect still at large is now the only person with access to the funds [19].

What to watch

  • Whether the fourth suspect is detained, and where the Belarusian and Kazakh suspects are being held.
  • What the Moscow court decides when Friedman's house arrest ends on December 8.
  • Whether Dodo Pizza or Russian authorities confirm Baza's figures: 3.7 TB of data, the $100,000 sale and the wallet lockout.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence58
Adoption
Not scored
Hype gap+30
Incentives
Not scored
Confidence60

Perspective Coverage

3 publishers
Builder
Builder 20%
Operator
Operator 57%
Investor
Investor 23%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Authorities say the group has four members in total, spread across Russia, Belarus and Kazakhstan.

    Reported SupportedView cited source
  2. [2]

    Risky.Biz says DataSuckers reportedly found valid credentials in Dodo Pizza's GitHub accounts and used them to access backend systems.

    Reported SupportedView cited source
  3. [3]

    Risky.Biz says Friedman connected to some of those systems from his home IP address, making it easy for Russian police to track him down and bring criminal charges.

    Reported SupportedView cited source
  4. [4]

    Baza says a group of four people may be involved, three alleged participants have been arrested, and they are citizens of Russia, Kazakhstan and Belarus.

    Reported SupportedView cited source
  5. [5]

    Baza says the Dodo Pizza login credentials were found in open access on GitHub and let the hackers into internal systems, then cloud storage, databases and passwords.

    Reported SupportedView cited source
  6. [6]

    Risky.Biz describes DataSuckers as a Lapsus and ShinyHunters-like hacking and data extortion group operating across the former Soviet space; Russian authorities have arrested three of its members.

    Reported SupportedView cited source
  7. [7]

    A 19-year-old named Denis A. Friedman, from Barnaul, was arraigned in a Moscow court on Wednesday; Risky.Biz said no other details were provided on the other two detained suspects.

    Reported SupportedView cited source
  8. [8]

    DataSuckers started operating this year and has been linked to at least three major hacks: Ukrainian supermarket chain ATB Market, Russian travel company Tez Tour and Russian pizza chain Dodo Pizza.

    Reported SupportedView cited source
  9. [9]

    Risky.Biz says the group typically breaches networks, steals data, destroys as many systems as possible and demands ransoms from victims, threatening to sell the stolen files.

    Reported SupportedView cited source
  10. [10]

    Russian authorities started investigating the group after its attack on Dodo Pizza, which operates more than 1,500 restaurants across 28 countries.

    Reported SupportedView cited source
  11. [11]

    Baza says the 19-year-old previously hacked Ukrainian websites but later chose a larger target in Russia.

    Reported SupportedView cited source
  12. [12]

    Friedman has been placed under house arrest for two months, until December 8.

    Reported SupportedView cited source
  13. [13]

    Friedman faces up to six years in prison if found guilty on the current charges.

    Reported SupportedView cited source
  14. [14]

    Belarus's National Center for Personal Data Protection confirmed the attack affected Belarusian customers of the network; names, addresses, emails, phone numbers, dates of birth and order details could have been compromised.

    Reported SupportedView cited source
  15. [15]

    The center explained that Belarusians' personal data was transferred to the Russian company within the framework of the franchising network.

    Reported SupportedView cited source
  16. [16]

    Nasha Niva reports that experts estimate the attackers accessed 3.7 TB, about 33 billion records, covering 15 years of orders, customers, employees and delivery addresses.

    Reported ContestedView cited source
  17. [17]

    Baza says the hackers put the stolen data up for sale on the dark web and received $100,000 for it.

    Reported ContestedView cited source
  18. [18]

    Baza says the buyer sent the whole sum to a crypto wallet that all four members could have used; after the 19-year-old's arrest, the other three changed the passwords and blocked his access.

    Reported InsufficientView cited source
  19. [19]

    Baza says two more alleged participants were soon taken into custody and only the last suspect, who remains at large, now has access to the money.

    Reported InsufficientView cited source
  20. [20]

    Nasha Niva, citing the Telegram channel Baza, says the Dodo Pizza breach occurred on September 28.

    Reported InsufficientView cited source

Sources

3 independent publishers whose own reporting we read for this story.

  1. nashaniva.com

    1 article · October 14, 2026

    Hackers who breached "Dodo Pizza" arrested. A Belarusian is among them
  2. news.risky.biz

    1 article · October 15, 2026

    Risky Bulletin: Russia arrests DataSuckers hacking group
  3. therecord.media

    1 article · October 16, 2026

    Moscow detains suspected DataSuckers hackers linked to breaches in Ukraine and Russia

Topics and entities

Topics

Entities