DoorDash Says Relax, Data Breach Only Exposed Names, Phones, Emails & Addresses

Food delivery giant DoorDash has once again come under negative limelight, this time with a massive data breach stemming from a sophisticated social engineering attack that targeted one of its employees in October. The incident allowed an unauthorized third party to gain access to and exfiltrate key contact information belonging to a mix of consumers, delivery drivers ("Dashers"), and merchants across its operating regions, including the U.S., Canada, Australia, and New Zealand. This latest breach is DoorDash's third major security failing since 2019 for anyone keeping count.

The attack was first identified by the company’s internal security team on October 25, and traced back to an internal employee who was tricked into compromising their credentials. Social engineering, the dark art of manipulating individuals into performing actions or divulging confidential information, remains a highly effective tactic for threat actors seeking to bypass complex technical defenses. In this case, the manipulation allowed the attackers to harvest personal records before DoorDash’s incident response team could successfully shut down the threat actor's access. 

In response to the incident, DoorDash has since initiated a series of mitigation and remediation steps. These include implementing enhancements to its security systems, reiterate employee training programs focused on identifying and resisting phishing and social engineering scams, plus hiring a leading third-party cybersecurity forensics firm to assist with the investigation.