Domino’s blames supplier for the claimed ‘hacking’ of customer accounts

Domino’s Pizza says an online rating system was the likely source of leaked customer personal details.

A Domino’s pizza shop. Photo: AFP

Domino’s Pizza says an online rating system was the likely source of leaked customer personal details.

It issued a statement today in response to posts by angry customers who say they received unsolicited emails — in one case pornographic content — at email addresses they used to buy pizza from Domino’s.

“We can share that the type of information is contained in an online rating system managed by the former supplier the information that spammers have is consistent with information via our online ratings customer feedback system,” Dominos says in a statement to The Australian.

“This system is now managed in house under Domino’s strict security standards.”

Domino’s hasn’t named the supplier, saying earlier today that they had received legal advice not to.

Domino’s has outsourced different spects of its business to a range of suppliers such as Precision Tracking for GPS Tracking, Flirtey for drone deliveries, and Marathon for its Dru robotics unit.

Domino’s statement implies that credit firm Equifax wasn’t the source of this particular hack. A breach at Equifax this year potentially exposed about 143 million Americans’ personal information, including names, addresses, dates of birth and social security numbers. Reports indicate UK customers’ data also was hacked, up to 694,000, according to the BBC.

Equifax this year was awarded Domino’s Business Partner of the Year award.

But that doesn’t seem relevant here, according to Domino’s statement.

In its statement to The Australian, Domino’s is adamant it “does not offer or sell any of its customer details to third parties”.

Domino’s has faced the ire of angry customers who received emails from third parties who knew their pizza buying habits.

“I’ve been getting lots of emails from ‘Sarah’ and ‘Jess’ lately,” one customer says on newssite Reddit.com. “They all know my name, email address and places close to where I live. Those places turned out to be Domino’s stores I’ve ordered at,” the posts says.

The post’s author says Domino’s had confirmed they had passed on details to a secondary supplier who had been hacked. But Domino’s would not disclose who the company was and why the supplier had the data. Nor would the pizza chain reveal why the alleged supplier had the data, the post says.

“I had been getting them too, I’d been in contact with them as well,” says another Reddit user.

“I have been affected by this as my data has obviously been stolen (been receiving emails and thought it was something else at first),” posts a third.

The alleged hacking doesn’t seem to be limited to Australia. In New Zealand there are similar stories.

On October 9, the website Newshub reported that a customer who used the alias ‘Professor Chandler’ only when ordering pizza began receiving unsolicited promotional material addressed to ‘Professor Chandler’, sent to their email address.

The Christchurch-based customer had been in contact with others who had received similar emails. Both the New Zealand and Australian emails were authored by a ‘Sarah’.

Another customer who posted on the Australian website Whirlpool.net.au claims to have received an email offering them work with a large shipping organisation. It was sent to an email address they used exclusively for ordering pizza.

Domino’s says it acted quickly to contain the information when it became aware of the issue and has commenced a detailed review process It says there is no need for customers to update their account passwords.

“Domino’s confirmed customers do not have to update passwords or details but recommends they don’t click on any links contained in the spam material, mark the emails as spam, and ensure their virus protection is up-to-date.”

The pizza company says it is in contact with the Office of the Australian Information Commissioner over this issue. Domino’s has not named the supplier.

The Australian Parliament this year passed mandatory data breach notification law requiring organisations that experience hacking to notify the Privacy Commissioner and to notify customers affected by the alleged breach. But the requirement does not come into force until next year.

This is not the first time Domino’s has faced concerns about customer details being hacked. In April a customer claimed someone hacked into his account and placed multiple orders for pizza.