Sandeep Goyal

Media has been abuzz over the past 48 hours about how pizza brand Domino’s India seems to have fallen victim to a serious cyber attack. According to Alon Gal, co-founder of an Israeli cybercrime intelligence, Under The Breach, the hackers have access to 13 TB of internal data from the servers of Domino’s India. This, says the Israeli agency, includes 180,000,000 order details containing names, phone numbers, emails, addresses, payment details, and a whopping 1,000,000 credit cards. Also hacked are employee details of over 250 employees at Domino’s across verticals such as IT, legal, finance, marketing, operations, etc.

As per Alon Gal, the hackers are aiming to sell the entire data to a single buyer. The hackers are looking for US$ 550,000 (around Rs 4 crore) for the entire database. The hackers also have plans to build a search portal to enable querying the data. The sale is apparently happening in the dark web, on a website frequented by cyber scammers. The ask is serious, and there could most likely be more than one willing buyer, albeit at a price much lower than currently being touted.

Domino’s India, meanwhile, has denied that its user data has been compromised in any which way. In a press statement, the Company stated, “Jubilant FoodWorks experienced an information security incident recently. No data pertaining to financial information of any person was accessed and the incident has not resulted in any operational or business impact. As a policy we do not store financial details or credit card data of our customers, thus no such information has been compromised. Our team of experts is investigating the matter, and we have taken necessary actions to contain the incident.”

Rajshekhar Rajaharia, the well-known cyber-security researcher who first alerted users about a big data leak at payments firm MobiKwik last month, partly corroborated the Domino’s press statement when he tweeted, “Again Big Data Leak! 20 Crore Order Details including 13 TB data of Domino’s India alleged leaked from #DominosIndia Server. Data Includes mobile, email, name, home address, payment type and Social Login Tokens. It seems Financial data is not there. #infosec #GDPR”. The only good news there seemed the part that, “Financial data is not there.”

Also Read: The writer’s ‘regulation’ block

Rajaharia is a well respected authority on cyber-hacking in India … he claims he had alerted the Indian Government’s Computer Emergency Response Team (CERT-In) about the the Domino’s data leak in March itself. Rajaharia had alleged a data breach at MobiKwik in March 2021 that apparently affected the data of 3.5 million users, exposing know-your-customer documents such as addresses, phone numbers, Aadhaar cards, PAN cards and more. Rajaharia estimated the size of the data breach to be 8.2 TB. MobiKwik denied the breach. Interestingly, Rajaharia had another take on the entire hacking episode. He has been on record saying, “It Seems, the same Hacker who alleged hacked #Mobikwik, was having #Domino’s Access from Feb. 2021. I had alerted CERT-IN on 5th march 2021 about this. Later first Hacker sold server access to some other reseller. Now They are planning to create another search engine”. My, my, my. Such wheels between wheels!

Now, I don’t want to get side-tracked by all these complicated hack tales and mind-numbing stolen terabytes. They were just backgrounders to set the context. My problem is simple: my daughter ordered a Domino’s pizza recently. Despite the press statement issued by Domino’s that no financial data has been taken away by the cyber-thieves, I am still worried. The Israeli cyber-expert is saying that details of 1 million credit cards have been pocketed by the hackers. He could well be exaggerating but what if his information is actually true? What if my daughter’s credit card actually stands compromised?

To Domino’s my daughter is an occasional customer … maybe once a month, plus or minus. Their broad-brushing the entire security breach is kind of understandable. Till there is really a crisis, why create panic? So far much of what is being shoveled around in media has no concrete evidence, for or against. So a public denial, from Domino’s perspective is probably sufficient.

But to Visa or Mastercard the issuers of the credit card, and to the bank that she patronises, she is an almost daily customer with substantial potential for financial damage. To them the relationship is deeper than just a pizza.

– Should Visa/Mastercard/the bank not have messaged/called all the 1 million customers that may have been potentially affected? When banks and credit card companies can keep sending all kinds of useless offers all the time to customers, why shy away from contact on such an important issue? The message could well have been simply that we are in touch with Domino’s and so far there is no cause for concern. No financial data has been compromised. What a relief it would be to all customers just to know that they are safe, their money is safe, and that the bank is well in control of the situation.

– It may not be an unnecessary precaution for the banks to ask all the 1 million odd customers that transacted with Domino’s to change their passwords. Sure Domino’s is saying that the financial data is not impacted but would a precautionary step really hurt anyone? Domino’s are most likely correct that they don’t store customer credit card data, because I presume they use a third party gateway that does not pass on those details to the pizza company’s servers. But most customers don’t actually know or understand all that.

Also Read: Facebook takes on Clubhouse, unveils upcoming audio products

– The question is why have the banks not reacted? The easiest answer to that is a prudent, ‘let sleeping dogs lie’ position that service organizations often tend to take. About 90% of the concerned customers would most probably be completely unaware of the Domino’s issue. They bought their pizza, paid for it and are now blissfully blind to whatever is happening at the pizza company. Why inform them, explain to them that there is perhaps a problem and get them worried when no one really knows the full truth yet and no damage has in any case been done?

– Now to the potential leakage of personal details … name, address, phone number, email, perhaps some more? Can public disclosure of such information be harmful? Who knows. It may not be part of this Domino’s breach but there have been reported breaches in other companies where bank account numbers, Aaadhar card details and PAN numbers got leaked. How are these companies to be made accountable?

Ransom demands on hacked data are not new to Domino’s Pizza. The hacktivist group Rex Mundi, back in 2014, claimed it breached the servers of Domino’s Pizza in France and Belgium, downloading approximately 600,000 customer records. In a statement posted to dpaste, a text-sharing application, Rex Mundi had then said it was able to download customers’ full names, addresses, phone numbers, e-mail addresses and passwords from the pizza company’s servers which Domino’s said were primarily used for promotional offers.

Is this Domino’s problem an occurrence we can ignore? Data breaches are becoming more and more frequent … and scary.

– In May 2019, the data of approximately 300 million Indian users on the Swedish mobile application, Truecaller, was leaked and made available for sale on the dark web.

– In 2019 itself, Amazon India faced a technical glitch, which exposed the tax reports of some of its sellers to others … approximately 400,000 of its sellers could easily download the tax reports of other competing vendors.

– Local search service, Justdial had a breach where personal data of over 100 million users of the search engine was exposed online due to a leaky expired API a couple of years ago.

Whatever be the eventual end to the Domino’s breach issue, I still think banks and service organizations need to become more responsive to customer concerns. Trying to wish it away may work once. Maybe twice. But God forbid, if and ever, the problem is of a serious nature, the backlash will be difficult to handle.

The author is the chairman of the Forum for Ethical Use of Data (FEUD). Views expressed are personal.

Watch BE+ | Way forward mantras for post COVID world | Leading marketing leaders like Deepa Krishnan, Anurita Chopra, Samir Singh to Santosh Iyer, across sectors in the special video series