Moscow Police Detain Suspected DataSuckers Hackers Linked to Breaches in Ukraine and Russia

Russian Police Detain Three Suspected DataSuckers Hackers

Russian authorities have detained three suspected members of a financially motivated hacking group calling itself DataSuckers, following an investigation triggered by a breach of Russian pizza chain Dodo Pizza. One named suspect, 19-year-old Denis Fridman of Barnaul, Russia, appeared before Moscow's Tverskoy District Court on Wednesday and was placed under house arrest until December 8, 2026. Two additional suspects were also detained, while a fourth alleged member of the group remains at large. According to Russian outlet Kommersant and Telegram news channel Baza, the group's members are reported to include citizens of Russia, Kazakhstan, and Belarus.

DataSuckers is a relatively new, financially motivated data-extortion group that researchers have compared to Lapsus$ and ShinyHunters for its tactics. It has claimed responsibility for breaches at three organizations in 2026: Russian pizza chain Dodo Pizza, Russian travel operator Tez Tour, and Ukrainian supermarket chain ATB Market — making it one of the few Russian-speaking cybercrime groups known to have targeted victims in both Russia and Ukraine during the ongoing war. Notably, it was the Dodo Pizza breach — a domestic, Russian victim — that triggered the Russian police investigation, not the Ukrainian ATB Market breach. No statement from Russia's MVD (Interior Ministry) or FSB has been publicly confirmed in available reporting as of this writing; the account of the arrests rests on Kommersant, Baza, and corroborating coverage from The Record and Risky Business Media.

Incident Details

Background: What DataSuckers Is Accused Of

The Dodo Pizza Breach

The investigation that led to the arrests began with an attack on Dodo Pizza, a chain that operates more than 1,500 restaurants across 28 countries. According to Kommersant and corroborating reporting from Risky Business Media, DataSuckers allegedly found valid Dodo Pizza corporate credentials exposed on GitHub and used them to reach interconnected company systems, including cloud storage, backend databases, and stored passwords. The group reportedly obtained records tied to roughly 300 million orders accumulated over 15 years. The stolen database was allegedly sold on the dark web for $100,000, with payment transferred to a shared cryptocurrency wallet — a wallet whose password was reportedly changed after Fridman's arrest. Fridman is accused of connecting to some of the compromised systems using his home internet connection, which allowed police to trace him to Barnaul.

The Tez Tour Breach

DataSuckers also claimed a breach of Tez Tour, a major Russian travel operator, in September 2026. Fridman is alleged to have participated in this intrusion as well, though public reporting provides fewer technical details than for the Dodo Pizza incident.

The ATB Market Breach

On October 5, 2026, DataSuckers claimed an attack on ATB Market, Ukraine's largest grocery retail chain, which operates more than 1,300 stores and employs over 60,000 people. The group claimed to have obtained 7.9 million customer records — including names, phone numbers, email and physical addresses, and password hashes — along with employee passport information and more than 11 million order records. DataSuckers reportedly demanded a $400,000 ransom and briefly posted a countdown timer on ATB's own website before it was removed. ATB has denied that customer data was compromised, describing the incident as routine "technical maintenance" and stating that "all information is securely protected." After ATB's denial, DataSuckers posted sample screenshots of the alleged stolen data to its Telegram channel and said it intended to sell the full database rather than leak it publicly. The scope of the ATB breach remains disputed — the company's denial and the group's claims have not been independently reconciled in public reporting.

Who Is DataSuckers

Researchers describe DataSuckers as a Lapsus$- and ShinyHunters-style extortion group operating across the former Soviet space, active since early-to-mid 2026. Its typical pattern, per available reporting, is to breach a victim's network, exfiltrate data, attempt to destroy internal systems, and then demand a ransom under threat of selling or leaking the stolen files. Security researcher Oleg Shakirov noted on social media that targeting both Russian and Ukrainian organizations makes DataSuckers an unusual case among Russian-language threat actors during the war.

Impact Assessment

Recommendations

For Organizations Using GitHub and Cloud Infrastructure

• Audit source-control repositories — including historical commits — for exposed credentials, API keys, and cloud access tokens; the Dodo Pizza breach reportedly started with corporate credentials left exposed on GitHub.
• Enable automated secret-scanning on all repositories and rotate any credential the moment it is found in version control, regardless of whether it appears to have been used maliciously.
• Segment cloud storage and backend databases so that a single leaked credential set cannot reach years of accumulated order or customer history in one step.

For Security and Incident Response Teams

• Treat long-retained historical data (Dodo Pizza reportedly stored 15 years of order records) as a liability; define retention and deletion policies that limit how much data a single breach can expose.
• Monitor dark-web marketplaces and Telegram channels for data samples matching your organization's customer or order databases, as DataSuckers has used both channels to pressure victims and advertise stolen data.
• When a vendor or partner denies a breach publicly, as ATB Market did, still activate internal monitoring for credential-stuffing or phishing campaigns that could exploit leaked data regardless of the official position.

For Customers of Dodo Pizza, Tez Tour, and ATB Market

• Change any password reused across services, particularly if you have an account with Dodo Pizza, since the breach reportedly included access to stored passwords.
• Be alert to phishing messages referencing specific past orders, addresses, or account details, which could indicate the sender obtained information from one of these breaches.
• Monitor for unexpected account activity or communications claiming to come from these companies, especially around claims of data for sale on dark-web forums.

Key Takeaways

1. Russian police detained three suspected members of the DataSuckers hacking group, with a fourth alleged member still at large; one named suspect, Denis Fridman (19, Barnaul), was placed under house arrest until December 8, 2026.
2. The investigation was triggered by a breach of Dodo Pizza, a Russian chain of more than 1,500 restaurants, where attackers allegedly used GitHub-exposed credentials to access cloud storage and databases covering roughly 300 million orders over 15 years.
3. DataSuckers has also claimed breaches of Russian travel operator Tez Tour (September 2026) and Ukrainian grocery chain ATB Market (October 5, 2026), making it one of the few Russian-speaking cybercrime groups to target victims on both sides of the war.
4. ATB Market has denied that customer data was compromised, despite DataSuckers' claim of 7.9 million customer records and an 11 million+ order dataset — leaving that breach's true scope unconfirmed.
5. Reporting indicates the suspect was identified after accidentally exposing his home IP address while accessing stolen data, rather than through any publicly disclosed law-enforcement cyber tool.
6. No statement from Russia's MVD or FSB has been confirmed in available coverage; the case so far is documented through Russian outlets Kommersant and Baza, corroborated by The Record and Risky Business Media.

Sources

• The Record — Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia
• The Record — Ukraine grocery chain ATB confirms cyberattack as hackers threaten to leak data
• Risky Business Media — Risky Bulletin: Russia arrests DataSuckers hacking group