Domino's India dominos.co.in Domino's India data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In March 2021, Domino's India (Jubilant FoodWorks) had customer data stolen. Have I Been Pwned lists 22,527,655 accounts with email addresses, names, phone numbers, physical addresses and order histories. The company said no financial data was accessed.
View all 13,118 breaches- Breach date
- 24 Mar 2021
- Affected
- 22,527,655
- Data exposed
- Email addresses, Names, Phone numbers, Physical addresses, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Domino's India is run by Jubilant FoodWorks. In April 2021, a large database of Domino's India customer data appeared for sale online, and the company acknowledged a data security incident that it dated back to March. It said it filed a complaint with the authorities and hired an outside forensic firm. It also said no financial information was accessed and that it doesn't store card details.
Claims in the press were much bigger than what Have I Been Pwned (HIBP) lists. A security researcher put the figure at 180 million order records, but the company didn't confirm a number. This page uses HIBP's count: 22,527,655 accounts, which it describes as 22.5 million unique email addresses.
Sources checked: haveibeenpwned.com, moneylife.in, theweek.in
Last verified against the official page:
What was exposed
The data included email addresses, names, phone numbers, physical addresses and order histories. HIBP doesn't list passwords or payment details.
What it lets criminals do
Delivery data is personal: it ties your name and phone number to a home address and to what and when you order. That is useful for targeted phishing and for scam calls that pretend to be about an order, a refund or a delivery.
What to do
No password was in the data, so the steps below are mostly about scam awareness.
What to do if you were in it
- 1
Expect phishing that mentions the breach
With your name, number and delivery address out, scammers can write emails and texts that look personal. Don't click links in unexpected messages. Go to the company's site yourself.
- 2
Be careful with calls about orders or refunds
If someone rings about a pizza order or a refund, don't give card numbers or OTP codes. Check in the official app or on the company's own site.
- 3
Keep one-time codes to yourself
No real delivery or support agent needs an OTP sent to your phone. Anyone who asks for it is trying to get into one of your accounts.
- 4
Check that your delivery apps use unique passwords
No passwords leaked here, but if you use the same one across food apps, change it and turn on two-factor login.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email and phone number, and Serus keeps monitoring and alerts you when your details turn up in a new leak.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Domino's India breach?
If you ordered from Domino's India before 2021, you might be. Look up your email on Have I Been Pwned or run a free Serus scan.
What was exposed?
Email addresses, names, phone numbers, physical addresses and order histories, according to HIBP.
Were my card details taken?
The company said no financial information was accessed and HIBP doesn't list any.
Is the 180 million figure true?
That number came from outside claims and the company didn't confirm it. HIBP lists 22,527,655 accounts.
Sources
- Have I Been Pwned: DominosIndia
- Have I Been Pwned: Domino's India Data Breach · haveibeenpwned.com
- moneylife.in/article/massive-data-breach-at-dominos-information-of-180-million-users-available-on-web/63992.html
- theweek.in/news/biz-tech/2021/04/19/dominos-india-hacked-customer-data-allegedly-up-for-sale-on-the-dark-web.amp.html
Something wrong or out of date? Tell us and we'll re-check it.
