Domino’s Pizza customers tell us they have received emails saying they account has been accessed by a third party.

Domino’s says its internal systems weren’t breached, but that individual accounts were logged into using a password and email combination stolen from another online account owned by the customer. This is known as credential stuffing.

Here’s the email:

“We’re getting in touch to let you know that we believe a very small number of Domino’s customer accounts were accessed by an unauthorised third party, and unfortunately your account is one of those affected.

We want to reassure you that our security systems have not been breached. We also don’t store any payment details, so no financial information has been accessed.

It appears that you have used a password for your Domino’s account which you have used on other sites, which was already out there because of a previous data breach unrelated to Domino’s. An unauthorised third party has used this to obtain access to your account. As a precaution, we’ve reset your account. You can still place orders as normal, but the next time you log in you’ll need to set a new password using the ‘Forgotten password’ link. We recommend choosing a strong, unique password that you haven’t used elsewhere. Please avoid reusing your previous password.

Keeping your information safe is really important to us. We’ve reported this incident to the Information Commissioner’s Office and included some FAQs below if you’d like more detail.

If you have any questions, our Customer Services team will be happy to help on 0800 640 9071.”

Credential stuffing is an attack where criminals take usernames and passwords stolen from one website and try them on many other websites. They don’t guess the passwords. They already have them, often millions at a time, from old data breaches, from malware that steals saved logins from people’s computers, or from phishing sites.

These lists are bought and sold on criminal forums. Attackers then use automated tools that run through the list and try each email and password pair against a login page, such as a food delivery app, a web shop, or a streaming service.

The attack works because so many people reuse the same password on different sites. If you used the same email and password for a small online forum that was breached years ago and for your pizza ordering account, the criminals don’t need to hack the pizza company at all. They just log in as you. To the company, it looks like a normal login with the correct password. That’s why these attacks often show up as “accounts were accessed” and not “the company was hacked.”

Once they’re in, attackers can order food or goods using your saved payment card, use up loyalty points or gift card balances, or collect your name, address, and phone number. They can use those details for more convincing scams later, for example a text or email that seems to come from the company because it knows what you ordered. Accounts that are confirmed to work are also resold to other criminals, so one reused password can cause trouble long after the original breach.

How to stay safe

• Use a different password for every account. That way, a breach at one site stays at that site.
• Use a password manager to remember those passwords. Nobody can remember dozens of unique passwords, but a password manager can store all these for you.
• Where it’s offered, turn on two-factor authentication (a code from an app or text message, or a passkey) so a stolen password alone isn’t enough to login to your account.
• If you’ve reused a password on an account that may have been affected, change it there and on every other site where you used it, starting with accounts that have payment details saved.
• Don’t follow links in emails or other unsolicited messaging. Log in directly on the official website or in the app.

Please note: Unsolicited “update your account” emails claiming to be from Domino’s are frequently phishing attempts designed to steal personal or financial information. When in doubt, Malwarebytes Scam Guard can help you determine whether a message is a scam or not and suggest follow-up steps.

This week on the Lock and Code podcast…

Twenty years ago, a British mathematician named Clive Humby popularized a phrase that came to describe data’s relationship with the entire global economy: “Data is the new oil.”

Pithy as the phrase sounds, it is undeniably true.

Data steers decisions at businesses of every size. Data created entirely new industries built around its capture. And, for a select number of companies, data has produced billions—if not trillions—of dollars in value.

So how is it that, on the dark web, your stolen identity can be purchased for just 95 cents?

That’s what a Malwarebytes researcher found last month after spending 48 hours inside the dark web to investigate cybercrime. Across a variety of forums and directories, he found subscription plans for malware that steals information once implanted on a device. He found guides for deploying social engineering scams. He found people selling their services to build fake websites that trick people into handing over their usernames and passwords. And he found one of the dark web’s most traded commodities—personal data, packaged together about individual people, to help a cybercriminal commit identity fraud.

These packages are called “fullz.” For victims in the United States, a fullz contains a full name, Social Security Number, date of birth, address, and other personal details. That is enough, on its own, for a cybercriminal to potentially open a bogus line of credit, file a fake tax return, access financial accounts, or obtain medical services under someone else’s name.

As we wrote on Malwarebytes Labs:

“For less than the cost of a cup of coffee, a cybercriminal can buy enough information to devastate someone’s financial life.”

It’s the kind of risk that could scare anyone, especially considering the scale behind it. In just the first six months of 2026, Malwarebytes found more than 7,500 compromised data sets on the dark web containing more than 8.4 billion records.

And yet, even today, cybersecurity professionals still get asked why anyone should bother protecting their data.

The public, understandably, are exhausted. With data breaches happening every week—if not every day—cybersecurity can start to feel pointless. With young people unable to build financial security, they start believing that they have nothing worth stealing. And with Big Tech already collecting our every movement, behavior, click, and concern, people understandably feel powerless to fight any kind of data abuse, be it corporate or criminal.

So today’s episode approaches the question from a different direction. This isn’t about why you should protect yourself—plenty of company websites will tell you that, and most of them rely on fear. This is about why hackers want your data in the first place.

Today, on the Lock and Code podcast, host David Ruiz explains how cybercriminals turn a single repeated password into account takeover, how a screenshot of your house from Google Maps became a tool in extortion emails, and why the most benign information about you—an address, an age, one public photo—is often the most useful data a stranger can buy.

Tune in today to listen to the full episode.

Show notes and credits:

Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 4.0 License
http://creativecommons.org/licenses/by/4.0/
Outro Music: “Good God” by Wowa (unminus.com)

Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it.

Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium for Lock and Code listeners.

Fast-food chain Chick-fil-A is warning customers after attackers hijacked loyalty accounts using stolen passwords in a credential stuffing attack.

Chick-fil-A says it detected suspicious login activity against some Chick-fil-A One accounts in June and launched an investigation. The company later concluded that unauthorized parties ran an automated credential stuffing attack against its website and mobile app between June 17 and June 19, 2026, using usernames and passwords obtained from previous data breaches or other third‑party sources. Chick-fil-A says it reset passwords and ended active sessions for affected accounts while investigating the incident.

Credential stuffing is an attack where criminals take username–password pairs stolen from one service and automatically try them on many other websites and apps to see where they still work. Because many people reuse passwords, attackers often gain access to accounts without ever breaking into the company’s systems in the traditional sense.

So, some may conclude that there are two sides to this. On the one hand, customers who reuse passwords across multiple sites make credential stuffing attacks much more likely to succeed. On the other, companies also have a responsibility to put protections in place to detect and block automated credential stuffing attacks before accounts are compromised.

How it works

To understand how it works, we’ve created a typical scenario:

• Cybercriminals obtain large lists of breached credentials from previous data breaches, dark web markets, or public dumps.
• They use automated tools to fire those credentials at login endpoints for popular services like retailers, banks, and loyalty programs.
• They take over accounts where the credentials still work, then siphon off stored value, personal data, or loyalty rewards, or resell the access to other criminals.

To a victim, this may seem like a breach at the company, but technically speaking, the cybercriminals already had the credentials and were able to enrich their database with additional information about the victims.

According to Chick-fil-A’s breach notifications, the attackers may have accessed a combination of:

• Name and email address.
• Chick-fil-A One membership number and mobile pay number.
• QR codes associated with the account.
• The balance of any Chick-fil-A credit, such as gift cards or rewards on the account.
• The last four digits of the stored credit or debit card number.

If you saved more details in your Chick-fil-A One account, attackers may also have seen:

• Birthdate (month and day).
• Phone number.
• Physical address.

Advice for Chick-fil-A customers

The real problem is that, over the years, we’ve designed and adopted a system that no longer works well for most people: passwords. We tell people not to reuse them and to use a password manager to keep track of unique passwords for every account. But for many people, password managers still seem complicated or untrustworthy. I’m afraid the same may turn out to be true for passkeys.

If you have or suspect you had a Chick-fil-A One account, you should act even if you haven’t received a letter.

• Set a new, unique password for your Chick-fil-A One account that you do not use anywhere else. And if you’ve used the same password elsewhere, change it on those accounts too.
• If you cannot log in because your account was locked or reset, follow Chick-fil-A’s recovery process.
• Turn on multi-factor authentication (MFA) if you haven’t already. Chick-fil-A supports MFA for Chick-fil-A One accounts using a verified mobile phone number.
• Be aware that attackers can use the exposed data to craft more convincing phishing messages and scams.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free →