Overview
- The company says names, email addresses, phone numbers and physical addresses were accessed for a subset of users across its marketplace.
- DoorDash reports no evidence of fraud or identity theft tied to the incident and says Social Security numbers, government IDs and payment data were not accessed.
- An employee was targeted in a social‑engineering attack; DoorDash cut off access, opened a forensic investigation with an external firm and notified law enforcement.
- The total number of affected individuals remains unspecified, and DoorDash says it has notified impacted users and implemented new security training and system enhancements.
- The roughly three‑week gap before public notification drew criticism and renewed scrutiny given prior incidents in 2019 and 2022, while DoorDash says Wolt and Deliveroo users were not affected.