Domino's pizza.dominos.be Domino's data breach: what happened and what to do
In June 2014, Domino's Pizza in France and Belgium was hacked and customer data was held to ransom. Have I Been Pwned counts 648,231 accounts, with email addresses, names, passwords, phone numbers and physical addresses. Passwords used weak MD5 hashing.
View all 13,115 breaches- Breach date
- 13 Jun 2014
- Affected
- 648,231
- Data exposed
- Email addresses, Names, Passwords, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In June 2014, Domino's Pizza in France and Belgium was hacked by a group calling itself Rex Mundi, which held the customer data to ransom, as WeLiveSecurity reported at the time. Domino's refused to pay. Six months later the attackers released the data, along with data from other hacked accounts. Have I Been Pwned (HIBP) added it in January 2015 and counts 648,231 accounts.
This is the French and Belgian business, not Domino's in the U.S. HIBP lists the site as pizza.dominos.be.
What was exposed
HIBP lists email addresses, names, passwords, phone numbers and physical addresses. The passwords were stored with MD5, a weak hashing algorithm, and no salt. That means they can be cracked quickly, so assume any password in the data is known.
The breach is old, which cuts two ways. The passwords are probably long since changed, but people reuse passwords for years, and a phone number and home address don't expire. If you ordered from Domino's in France or Belgium around 2014, the address and phone number are still useful to scammers.
What this means now
Check whether your email is in the data. If it is, the main risks are an old password reused on other accounts and phishing that uses your name and address. Both are cheap to fix.
What to do if you were in it
- 1
Change the password, and anywhere you reused it
If you had a Domino's account, change that password and the password on any other site that used the same one. Use a different password for each site.
- 2
Turn on two-factor authentication
Add two-factor login on your email and bank accounts first, then your other main accounts.
- 3
Expect phishing that mentions the breach
Treat emails and texts that greet you by name, or mention this breach, with suspicion. Don't click the links; go to the company's site directly.
- 4
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web and alerts you when your email, passwords or other personal data appear, and tells you what to do next. It can't remove data that has already leaked, so the alert is the point: it tells you which passwords to change. You can run a free scan.
Frequently asked
Was I affected by the Domino's breach?
Search your email on Have I Been Pwned. 648,231 accounts are listed, from Domino's in France and Belgium.
What was exposed?
Email addresses, names, passwords, phone numbers and physical addresses. Passwords were stored with unsalted MD5.
Should I change my password?
Yes, if you used a Domino's password anywhere else. Unsalted MD5 hashes are easy to crack.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
