Business

DoorDash data breach affects personal info of 4.9 million customers, merchants

Online food-delivery service DoorDash says it's the victim of a data breach in which the personal information of 4.9 million people was stolen, including names, email addresses, delivery addresses, phone numbers, and partial banking and credit card details.

U.S.-based food-delivery company says 'unauthorized third party' accessed user data May 4

DoorDash, a service that allows people to order food online for delivery, has been hit by a data breach, the San Francisco-based company has confirmed. (DoorDash)

Online food delivery service DoorDash says it's the victim of a data breach in which the personal information of 4.9 million people was stolen, including names, email addresses, delivery addresses, phone numbers, and partial banking and credit card details.

DoorDash, which allows people to order food from a website or smartphone to be delivered to them, said Thursday an "unauthorized third party" accessed some of the San Francisco-based company's user data on May 4.

As a result, information on customers, merchants and even some delivery drivers was stolen, including partial — but not complete — banking and credit card data, and driver's licence numbers for 100,000 delivery people. 

The company said it has closed the access point the cybercriminals used, but the result is anyone who joined the service before April 5, 2018, is possibly impacted. Anyone who joined after that date is not.

Change passwords, DoorDash urges

DoorDash says it is in the process of contacting everyone affected, but as a precaution, it is encouraging all customers to change their passwords via a dedicated website

The company operates in 4,000 cities, including 92 markets scattered across every Canadian province, so some Canadians are impacted.

But the company won't say how many, exactly.

"The overall proportion of users affected represents a small percentage of our community," spokesperson Mattie Magdovitz told CBC News.

"We remain wholly focused on our investigation and on doing the right thing for the DoorDash community, particularly those affected."

 

Comments

To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.