Breach Disclosure: Domino's India

In 2021, Domino's India, which is operated by the parent organization Jubilant Foodworks Limited who is the master franchisee for Domino's Pizza in India, suffered a data breach in which 13 TB of data containing employee records for 250 employees, details for 180 million orders, and 1 million credit cards were allegedly exposed. The breach involved the release of names, phone numbers, emails, delivery addresses, and payment details. The leaked data was originally posted for sale on cybercriminal underground marketplaces in April 2021.

Standing Intelligence Requirements

PII & Fraud

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On May 25, 2021, Domino's India disclosed a data breach against their network. The breach originally occured in April, 2021, and was offered for sale by the Raid Forums actor "BRBbrbt" on April 16, 2021, and then again in May 2021. Jubilant FoodWorks Limited is the parent company of Domino's India, and is the major franchisee in India for Domino's Pizza. The database allegedy contains data from 2015-2021 with Outlook mail archives, including all internal files of 250 employees from IT, Legal, Finance, Marketing, Operations, and other departments. It also contains all customer information, 180 million order details (name, phone number, email, delivery address, payment details), and 1 Million credit cards used to purchase on Dominos mobile application. The threat actor offered the database for sale for 10 BTC (about USD 570,000 at the time) and then demanded a ransom of 50 BTC (about USD 2.8M at the time) or they would build a search portal of the data. That portal appears to have launched in May, 2021, as a Tor dark web search engine run by the threat actor.