DoorDash doordash.com DoorDash data breach 2022: what happened and what to do
In August 2022 attackers used a phished vendor's credentials to reach DoorDash's internal tools. Have I Been Pwned lists 367,476 accounts, with names, email addresses, delivery locations and partial card data.
View all 13,115 breaches- Breach date
- 2 Aug 2022
- Affected
- 367,476
- Data exposed
- Email addresses, Geographic locations, Names, Partial credit card data
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In August 2022, DoorDash disclosed that attackers had reached some of its internal tools using the stolen credentials of a third-party vendor. DoorDash said the vendor had been compromised by a phishing attack, and didn't name it. The company told reporters the incident was linked to the same threat actors who had hit the messaging company Twilio, which had said that several of its own employees fell for a text message phishing attack.
Have I Been Pwned (HIBP) dates the breach to 2 August 2022, added the data on 7 January 2023 and lists 367,476 affected accounts. One secondary source claimed a figure of 4.9 million people, including merchants and drivers. Nothing else backed it up. Use HIBP's count.
Why it's a good example of a supply-chain breach
Customers didn't do anything wrong. A vendor with access to DoorDash's internal tools was tricked, and the attackers used that access. The Twilio attacks were part of a wider phishing campaign that targeted many companies in the same way. That's why a small mistake at a supplier can reach a company with much better security.
What was exposed
HIBP lists four types of data: names, email addresses, geographic locations and partial credit card data. For customers, DoorDash said the exposed information included names, email addresses, delivery addresses and phone numbers. A small number of customers also had the card type and the last four digits of a card exposed. For Dashers, the company's drivers, names, phone numbers and email addresses may have been accessed.
DoorDash said it had no reason to believe the information had been misused for fraud or identity theft.
What that lets criminals do
A name, delivery address and phone number are enough for a phishing text that looks real. "Your DoorDash order can't be delivered" is a standard lure, and now the message can include your real address.
The last four digits of a card don't allow a purchase. But they're often used as a "verification" step by scammers pretending to be a bank or a delivery service, so don't treat them as proof that a caller is genuine.
Delivery addresses are the more personal part. They show where you live and when you order food. That's enough to be unsettling, though not by itself dangerous.
The company's response
DoorDash said the phishing campaign didn't compromise sensitive information and that it had no reason to believe the data had been misused. For anything related to the breach, rely on messages that come through DoorDash's own app or website.
What to do
The sensible reaction is to be careful with messages that mention a delivery. You can't change a leaked name or address, but you can stop trusting a message just because it knows them.
What to do if you were in it
- 1
Be careful with delivery texts and emails
Messages about a missed delivery, a payment problem or an account lock are the obvious phishing hooks. Open the app yourself and don't click links in texts.
- 2
Don't use your card's last four digits as proof of identity
A caller who quotes them may have taken them from a breach. Hang up and call the number on the back of your card.
- 3
Change your DoorDash password and turn on two-step verification
Passwords weren't listed by HIBP, but it's cheap insurance, and so is changing any copy of the password elsewhere.
- 4
Review your card statements
Look for charges you don't recognize. If you see one, contact your card issuer and ask for a new card.
- 5
Check whether your email or phone number is in this and other breaches
A free scan from Serus shows which breaches include your email or phone number. Serus monitors breach databases and the dark web and alerts you when your data shows up. It can't remove data from a breach, so the alert tells you what to change.
Frequently asked
Was I affected by the DoorDash data breach?
Search your email address on Have I Been Pwned. It lists 367,476 accounts from this breach.
What was exposed?
HIBP lists names, email addresses, geographic locations and partial credit card data. DoorDash said customer phone numbers and delivery addresses were included, and for a small number of customers the card type and last four digits.
How did the attackers get in?
DoorDash said they used stolen credentials from a third-party vendor that was compromised in a phishing attack.
Should I change my password?
It's a good precaution. HIBP doesn't list passwords for this breach, but a fresh unique password costs nothing.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
