Domino's Pizza Customer Data Breach Exposes 648K Accounts with Weak MD5 Password Hashes
What Happened – In June 2014 a hacking group calling itself “Rex Mundi” breached Domino’s Pizza’s French and Belgian customer portal. The attackers exfiltrated 648,231 records containing email addresses, names, phone numbers, physical addresses and passwords that were stored using unsalted MD5 hashes. Domino’s refused to pay the ransom; the data were later published publicly.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential‑storage controls – a core control objective for any continuous assurance program.
- Highlights the need for immutable evidence that password‑hashing algorithms meet industry‑accepted strength criteria.
- Shows how a single weak cryptographic practice can invalidate broader data‑privacy and security attestations.
Who Is Affected – Retail & e‑commerce (food‑service) organizations that manage consumer accounts; their customers whose personal data were exposed.
Recommended Actions
- Conduct an immediate audit of all password‑storage mechanisms and replace unsalted MD5 with a modern, adaptive hash (e.g., bcrypt, Argon2).
- Update password‑policy documentation and capture evidence of enforcement for audit readiness.
- Incorporate credential‑storage checks into continuous control‑monitoring dashboards to provide a defensible audit trail.
Technical Notes – Attack vector: unknown (external compromise). Data types exposed: email, name, phone, address, password (MD5, no salt). Source: Have I Been Pwned