DoorDash notifies users of data breach

DoorDash experienced a significant data breach in October 2025, in which an unauthorized third party accessed the personal information of some customers, Dashers, and merchants. The compromised data included names, physical addresses, email addresses, and phone numbers, but did not include sensitive financial details, Social Security numbers, or payment card data.​

How the Breach Happened

The breach originated from a social engineering attack targeting a DoorDash employee, allowing attackers to bypass technical safeguards by manipulating human behavior. Once detected, DoorDash’s security team shut down the unauthorized access and involved law enforcement for further investigation.​

What Data Was Exposed

• First and last names

• Physical addresses (delivery/billing)

• Email addresses

• Phone numbers

Sensitive data such as Social Security numbers, government-issued IDs, and payment card details remained secure and were not accessed.​

Affected Parties and Response

• The breach affected a mix of DoorDash customers, Dashers (drivers), and merchants.​

• DoorDash implemented additional security measures, enhanced employee security training, and engaged cybersecurity specialists to investigate and prevent future incidents.​

• DoorDash notified affected individuals and advised them to be vigilant for phishing attempts and suspicious communications claiming to be from DoorDash, especially those that request personal or financial details.​

Potential Risks and Recommendations

While no financial information was disclosed, the leaked data could be used for targeted phishing or social engineering attacks. Users are advised to monitor their accounts, avoid clicking suspicious links, and enable enhanced security measures such as two-factor authentication.​

This breach underscores the persistent risks posed by social engineering and the importance of both technical safeguards and employee security awareness.​