Domino’s Pizza customers targeted in credential stuffing attacks

Domino’s Pizza has notified customers that a small number of accounts were accessed by an unauthorized third party through credential stuffing attacks. The company clarified that its internal security systems were not breached.

The unauthorized access occurred because attackers used email and password combinations stolen from unrelated, previous data breaches. Because affected users reused these credentials on their Domino’s accounts, attackers were able to log in successfully. Domino’s stated that it does not store payment details, so no financial information was compromised during these incidents.

As a security precaution, the company has reset the affected accounts. Impacted users are required to set a new, unique password via the ‘Forgotten password’ link before they can log in again. The company has reported the incident to the Information Commissioner’s Office.