Domino’s customers targeted in credential-stuffing attacks using reused passwords
Summary
Domino’s says a very small number of customer accounts were accessed using email-password pairs exposed in unrelated breaches. It says its systems were not breached and no payment details were accessed; affected accounts were reset.
Key points
- Domino’s says a very small number of customer accounts were accessed by an unauthorized third party using passwords reused from other sites.
- The company says its internal systems were not breached and that no payment details were accessed.
- Domino’s reset affected accounts and advised customers to set a new, unique password; it says it reported the incident to the UK Information Commissioner’s Office.
- Credential stuffing uses automated tools to try email-and-password pairs stolen from other services against additional sites.
- Stolen account access may expose personal details or allow attackers to use saved payment cards, loyalty points, or gift card balances.
- Use unique passwords and a password manager, enable two-factor authentication where available, and change reused passwords on affected accounts and elsewhere.
Article Details
- Victim Organization
- Domino’s Pizza
- Incident Type
- Credential stuffing resulting in unauthorized access to individual customer accounts, according to Domino’s; the company says its internal systems were not breached.
- Affected Records
- Domino’s described a very small number of affected customer accounts; no exact count was disclosed.
- Affected Data Size
- Not disclosed
- Operational Impact
- Domino’s reset affected accounts, requiring customers to set new passwords at their next login. Customers could continue placing orders normally. The company said it does not store payment details and no financial information was accessed.
- Ransom Or Extortion
- Not disclosed
- Claim Status
- confirmed