22.5 M Domino's India Customer Records Exposed in 2021 Data Breach
What Happened — In March 2021 Domino’s India suffered a breach that exposed 22,527,655 customer records. The compromised data—email addresses, names, phone numbers, physical addresses and order histories—appeared for sale on a hacking forum in April 2021. Domino’s publicly acknowledged the incident after the data surfaced.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate privacy‑by‑design controls and the need for continuous evidence that personal data is protected.
- Highlights the importance of a defensible audit trail for consent, data minimisation and retention policies—key elements of a control‑assurance program.
- Aligns with Verisq’s CookiePLUS Privacy capability, which helps organisations capture, manage and prove consent and data‑handling evidence across the data lifecycle.
Who Is Affected – Retail & e‑commerce (food‑service) operators that collect customer contact and purchase information; any third‑party service providers handling the same data.
Recommended Actions
- Conduct a privacy impact assessment (PIA) focused on data collection, storage and sharing practices.
- Implement a consent‑management solution that records granular opt‑in/opt‑out choices and provides audit‑ready logs.
- Review and tighten data‑retention schedules; securely delete data no longer needed for business purposes.
- Document the breach response process and retain evidence for regulatory inquiries. Source: https://haveibeenpwned.com/api/v3/breach/DominosIndia
Technical Notes – The breach involved the unauthorized extraction of a 13 TB dataset containing personal identifiers and order histories. No specific vulnerability or attack vector was disclosed; the compromise is classified as an unknown‑origin data exfiltration. Source: https://haveibeenpwned.com/api/v3/breach/DominosIndia