Deliveroo and Domino’s among most-hacked food delivery companies

guest · Oct 7, 2019

Deliveroo and Domino’s among most-hacked food delivery companies
October 7, 2019
https://www.verdict.co.uk/food-delivery-hacked/

This is according to global cybersecurity company DynaRisk, which investigated the types of sites targeted by cybercriminals. The company obtained over 1,000 configuration files for a popular hacking tools “from the dark web and hacker communities” and discovered that online food delivery services are frequently targeted.

The top five most frequently targeted brands were Domino’s, Deliveroo, Nandos, Papa Johns and Morrisons. Tescos, Pizza Hut and Subway were also in the top ten.
DynaRisk also found that of all the European companies targeted, .co.uk domains have the highest number of hits, suggesting UK companies are more at risk.
Food delivery companies hacked: Are careless cybersecurity practices to blame?
He believes that for platforms where card details are stored, good cybersecurity practices are of high importance

“When hacks of this nature happen and scams occur, it can be difficult to reclaim any money stolen since it becomes difficult to prove the transaction was made fraudulently. This makes the security of credentials on these platforms crucial to safeguard.
Click to expand...

guest · May 19, 2020

Hackers Are Trading Your Free Pizza (and Personal Details) on the Dark Web
Although many restaurants' user accounts are available on dark web marketplaces, few have sold as widely as Domino's Pizza accounts
We explain how accounts have been hacked and how you can secure your account in the future
May 18, 2020
https://www.comparitech.com/blog/information-security/hacked-dominos-pizza-accounts/

If you’ve never updated your Domino’s Pizza account information, you may want to do so, and soon. Hackers are engaged in an on-going credential stuffing operation against the well-known international pizza brand, with their sights primarily set on Domino’s Pizza customers in the US. After scouring posts on more than a dozen dark web marketplaces, we discovered over 12,000 Domino’s Pizza accounts have been sold, and most within the past 12 months.
Why are hackers targeting Domino’s Pizza accounts?
While it may seem counterintuitive, hackers and their buyers aren’t immediately after Domino’s shoppers’ credit card information. Instead, they’re on the hunt for rewards points and free pizza.
How much are hackers earning from Domino’s Pizza account selling?
The majority of account sellers likely aren’t earning big bucks by selling Domino’s Pizza accounts. In fact, only a small number of sellers’ posts had any sales at all. And most posts listed prices in the $1 to $5 range.
A few posts with a high volume of sales presented list prices over $1,000.
Click to expand...

How much money have Domino’s customers lost?
With a non-discounted price of $12.99 for a medium two-topping pizza, Domino’s customers have lost a minimum of $160,000 in potential free pizza within the past 12 months.
The $160,000 figure is a significantly lower bound estimate. It’s quite possible that the loss value for Domino’s customers is much higher than that.

The threat may appear limited, but its impact is more expansive than just a few stolen pizzas.
Click to expand...

guest · Oct 14, 2020

Chowbus delivery service breached, hacker emails data to users
October 6, 2020
https://www.bleepingcomputer.com/ne...service-breached-hacker-emails-data-to-users/

A threat actor has hacked into the Chowbus food delivery service and emailed links to the stolen data to all customers.

Chowbus is a mobile-based Asian food delivery service that allows customers to order food from local restaurants in cities around the USA, Australia, and Canada.
At 1:33 a.m. yesterday, Chowbus customers began receiving mysterious emails titled "Chowbus data," which simply stated, "Download Chowbus data here."

According to numerous customers who received these emails, the links led to comma-separated values text files (CSV) that contained the exported databases for Chowbus.
Click to expand...

In an email to customers, Chowbus explained that they are investigating the hack, but none of the exposed data contained financial information or passwords.

"At approximately 1:30 a.m. CDT on October 5, Chowbus learned that some of our user data had been illegally accessed and made available online. As soon as we became aware of this incident, our security team quickly took steps to start addressing the issue."
BleepingComputer has contacted Chowbus with further questions but has not heard back yet.
Click to expand...

Have I Been Pwned:

Chowbus
In October 2020, the Asian food delivery app Chowbus suffered a data breach which led to over 800,000 records being emailed to customers. The email contained a link to a CSV file with customer data including physical addresses, names, phone numbers and over 444,000 unique email addresses.

Breach date: 5 October 2020
Date added to HIBP: 6 October 2020
Compromised accounts: 444,224
Compromised data: Email addresses, Names, Phone numbers, Physical addresses
Permalink
Click to expand...

guest · Aug 18, 2021

FBI warns of credential stuffing attacks against grocery and food delivery services
August 17, 2021
https://therecord.media/fbi-warns-o...s-against-grocery-and-food-delivery-services/

The FBI says that hackers are using credential stuffing attacks to hijack online accounts at grocery stores, restaurants, and food delivery services in order to drain user funds through fraudulent orders and to steal personal or financial data.

The warning comes via an FBI Private Industry Notification the agency’s Cyber Division sent last week to companies in the US food and agricultural sectors.
The agency said that cybercriminal groups are using username and password combos obtained through breaches at other companies to log into customer accounts at grocery and food delivery services, hoping that users had reused passwords across accounts.
Click to expand...

Because most grocery, restaurants, and food delivery accounts tend to run a reward points program and typically store payment card information, cybercrime groups started focusing their efforts on hijacking these types of accounts over the past year.

In addition, independent reporting from threat intelligence company DarkOwl also noted a rise in the number of underground ads offering access to restaurant and food delivery accounts, a spike that appears to have taken place since the onset of the COVID-19 pandemic in early 2020.
Click to expand...

Now, the agency wants companies to improve their security defenses against these types of attacks.
Click to expand...

guest · Nov 21, 2021

Turkish food platform Yemeksepeti denies hack for ransom claims
November 16, 2021
https://www.dailysabah.com/business...orm-yemeksepeti-denies-hack-for-ransom-claims

Turkey’s largest online food ordering website and application Yemeksepeti denied claims on Tuesday that its database was breached by hackers demanding ransom.

In a statement early Tuesday on Twitter, Yemeksepeti said that some “ill-minded” people contacted the company and threatened to release unaccredited data associated with the platform, demanding ransom in exchange.
It is impossible for Yemeksepeti to even consider evaluating such illegal demands, the company said, adding all related public institutions were informed of the incident and legal processes were launched.
Click to expand...

Hackers, on the other hand, reiterated their claim and accused Yemeksepeti of lying since the company does not know how the breach took place, threatening to release addresses and phone numbers of employees within a week if their demands are not met.

Yemeksepeti’s user data was hacked earlier in March as acknowledged by the company, which stated that payment and credit card information remained safe.
Click to expand...

The company is the pioneering online food platform in Turkey and saw rapid expansion in the Middle East and the Balkans before it was acquired by Germany-based Delivery Hero for $589 million in 2015.
Click to expand...

guest · Feb 8, 2023

Weee! grocery service confirms data breach, 1.1 million affected
By Lawrence Abrams @LawrenceAbrams - February 8, 2023

The Weee! Asian and Hispanic food delivery service suffered a data breach exposing the personal information of 1.1 million customers.

Weee! claims to be the largest Asian and Hispanic grocery store in North America, delivering food across 48 states in the USA via warehouses spread throughout the country.
Click to expand...

On Monday, a threat actor named 'IntelBroker' began leaking the data for Weee! on the Breached hacking and data breach forum.
According to the forum post, "In February 2023, a database of 11 million customers belonging to the Sayweee was stolen by hackers."

The leaked database contains Weee! customers' first and last names, email addresses, phone numbers, device type (iOS/PC/Android), order notes, and other data the delivery platform uses.
Click to expand...

After contacting Weee! about the breach, the company confirmed to BleepingComputer that customer information was stolen in the data breach.

"We recently became aware of a data breach that has affected some customer information," reads the complete statement from Weee!.
"Security is a top priority for us and we are undertaking a thorough review to ensure we continue to deliver on the trust the Weee! Community places in us."
Click to expand...

While the threat actor stated the leak contains 11 million customers, Troy Hunt of the Have I Been Pwned data breach notification service told BleepingComputer that the leaked data only includes 1.1 million unique email addresses.

To check if your information was exposed in this breach, you can search for your email address on Have I Been Pwned later today after the data is added.
Click to expand...

Log in or Sign up

Deliveroo and Domino’s among most-hacked food delivery companies

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Deliveroo and Domino’s among most-hacked food delivery companies

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches