Moscow Court Orders House Arrest for DataSuckers Suspect After Dodo Pizza IP Leak

The arrests stem from a breach that began with corporate credentials posted on GitHub, granting access to interconnected cloud storage, databases, and stored passwords across Dodo Pizza systems. Attackers exfiltrated records tied to hundreds of millions of orders spanning 15 years and sold the archive for $100,000 via a shared cryptocurrency wallet whose password changed post-arrest. Two additional suspects from Russia, Kazakhstan, and Belarus were detained while a fourth remains at large.

Kommersant and Baza reporting shows police traced Fridman through the accidental IP exposure during data access, not through advanced attribution. The group previously hit Tez Tour and ATB, claiming large customer datasets in each case, though victim statements dispute full compromise. DataSuckers maintains a public Telegram channel and describes itself as financially motivated, communicating exclusively in Russian.

Technical evidence indicates opportunistic criminals exploiting public misconfigurations rather than state-directed operations. Russian charges focus narrowly on illegal handling of personal data, avoiding broader cybercrime statutes. No independent verification exists for the claimed dataset sizes or extortion payments.

The wallet password change suggests remaining members are attempting to secure funds. Expect further tracing of cryptocurrency flows and possible additional arrests if transaction patterns link to known Russian exchanges within the next 90 days.