Hackers accessed DoorDash buyer info and a few partial fee knowledge
Meals supply big DoorDash has confirmed an information breach that uncovered clients’ private info.
In a weblog publish shared with TechCrunch forward of its publication at market shut, DoorDash stated malicious hackers stole credentials from staff of a third-party vendor that had been then used to realize entry to a few of DoorDash’s inside instruments.
DoorDash stated the attackers accessed names, e-mail addresses, supply addresses and telephone numbers of DoorDash clients. For a “smaller subset” of customers, hackers accessed partial fee card info, together with card sort and the final 4 digits of the cardboard quantity.
For DoorDash supply drivers, or Dashers, hackers accessed knowledge that “primarily included title and telephone quantity or e-mail deal with.” Customers of Wolt, the Helsinki-based on-line ordering and supply firm acquired by DoorDash final yr, are unaffected.
DoorDash says {that a} “small proportion” of customers had been affected by the incident however declined to say what number of customers it at the moment has or present an correct variety of affected customers.
The corporate stated it minimize off the third-party vendor’s entry to its methods after discovering “uncommon and suspicious” exercise.
DoorDash didn’t title the third-party vendor, which “gives companies that require restricted entry to some inside instruments,” in line with DoorDash spokesperson Justin Crowley, however confirmed to TechCrunch that the seller breach is linked to the phishing marketing campaign that compromised SMS and messaging big Twilio on August 4. Researchers linked these assaults to a wider phishing marketing campaign by the identical hacking group, dubbed “0ktapus,” which has stolen near 10,000 worker credentials from not less than 130 organizations, together with Twilio, web firms and outsourced customer support suppliers, since March.
DoorDash wouldn’t say when it found it was compromised, however its spokesperson stated that the corporate took time to “absolutely examine what occurred, which customers had been impacted and the way they had been impacted” earlier than disclosing the info breach.
DoorDash says that since discovering the compromise the corporate employed an unnamed cybersecurity professional to assist with its ongoing investigation and is taking motion to “additional improve DoorDash’s already sturdy safety methods.”
This isn’t the primary time that hackers have stolen buyer knowledge from DoorDash’s methods. In 2019, the corporate reported an information breach affecting 4.9 million clients, supply staff and retailers who had their info stolen by hackers. It additionally blamed the breach on an unnamed third-party service supplier.
Learn extra:
From the archives:
August 26: An earlier model of this story incorrectly acknowledged that Sign staff had credentials stolen by the phishing marketing campaign; this was as a result of an modifying error. We remorse the error. ZW.
