DoorDash says a social engineering attack led to a data breach exposing names, addresses, emails, and phone numbers of users, Dashers, and merchants.
U.S.-based food delivery and logistics company DoorDash announced that a social engineering attack led to a data breach.
“Our team recently identified and shut down a cybersecurity incident that involved an unauthorized third party gaining access to and taking certain user information.” reads a statement published by the company on the cybersecurity incident. “Importantly, no sensitive information was accessed by the unauthorized third party and we have no indication the data has been misused for fraud or identity theft at this time.”
The company confirmed that one of its employees fell victim to a social engineering scam, but it cut off the intruder’s access and alerted law enforcement. Exposed data include names, addresses, emails, and phone numbers of users, Dashers, and merchants.
“DoorDash employee was recently targeted in a social engineering scam. The response team identified the incident, shut down the unauthorized party’s access, started an investigation, and referred the matter to law enforcement.” continues the statement.
The company pointed out that no sensitive data like SSNs, IDs, driver’s licenses, or bank/payment details was accessed.
DoorDash says there’s no evidence the stolen data has been misused, the company also confirmed that Wolt and Deliveroo customers were not affected.
The U.S.-based food delivery and logistics company notified impacted users.
At this time it is unclear the scope of the data breach and the number of impacted individuals.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, DoorDash)
