DoorDash Confirms Customer Data Stolen in Security Breach

According to AppleInsider, DoorDash has confirmed that hackers stole customer personal information including names, phone numbers, email addresses, and physical home addresses. The company buried the announcement in a support document within its “Manage Your Account” section rather than making a public statement. DoorDash claims no “sensitive” data was accessed, but their definition of sensitive excludes home addresses which most people would consider highly sensitive. The breach occurred through a social engineering scam targeting an employee, though the company hasn’t revealed exactly when this happened. They’ve hired an external firm to investigate and notified law enforcement, while affected customers are being told to reference case number “B155060” when contacting their call center.

The social engineering problem

Here’s the thing about social engineering attacks – they’re often more effective than technical hacking. Basically, you’re targeting the human element rather than trying to break through firewalls or encryption. DoorDash stopped short of explaining exactly what happened, but typical social engineering involves tricking employees into revealing credentials or granting access through phishing emails, fake support calls, or other manipulation tactics. And honestly? These attacks are notoriously difficult to defend against because they exploit human psychology rather than technical vulnerabilities.

What counts as “sensitive” anyway?

DoorDash’s definition of sensitive data seems pretty narrow, doesn’t it? They’re basically saying that unless it’s your Social Security number or bank details, it’s not really sensitive. But think about what hackers actually got: your full name, phone number, email, and most concerningly, your physical address. That’s essentially everything someone would need to target you for everything from identity theft to physical security risks. I mean, would you want random strangers knowing where you live? Probably not.

The aftermath and response

So what’s DoorDash actually doing about this? They mention “enhancements” to security systems and new employee training, which sounds like the standard corporate response. But hiring an external investigation firm suggests this might be more serious than they’re letting on. The bigger question is why they’re being so vague about when this happened. Was it last week? Last month? Customers deserve to know the timeframe to understand their potential exposure. And hiding the announcement in a support document rather than being upfront? That doesn’t exactly inspire confidence in their transparency.