DoorDash Confirms October Data Breach After Social Engineering Attack

DoorDash has disclosed a new data breach stemming from an October 25, 2025 cybersecurity incident in which an employee was tricked through a social engineering scam, giving an unauthorized third party access to internal systems. According to notification emails and public reporting, the attacker obtained contact information for an unspecified number of consumers, delivery workers, and merchants, including names, physical addresses, phone numbers, and email addresses.

In its advisory, DoorDash said the incident involved contact data only and stated that payment card numbers and account passwords were not accessed. However, references in the company’s online security notice to U.S.-specific identifiers such as Social Security Numbers have raised questions about the scope of potentially exposed information, and some impacted users have criticized the company’s characterization of the data as non-sensitive.

Reports indicate that DoorDash identified the incident on October 25 and later notified affected users by email, with some recipients noting that nearly three weeks elapsed between detection and notification. The company has not provided a precise count of affected individuals, but it acknowledges that customers in multiple countries are impacted, and analysts point to DoorDash’s large user base as a factor that may amplify downstream risk. The incident, which the company says is now contained, has been referred to law enforcement, and DoorDash reports that it has brought in a cybersecurity forensics firm, implemented additional employee training, and deployed further security controls.

This is at least the third significant security incident involving DoorDash, following a 2019 breach that affected roughly five million users and a 2022 incident related to a broader campaign that also targeted other technology firms. For security leaders, the case underlines the continued effectiveness of social engineering against employees as a path to compromise and the importance of treating contact datasets as sensitive, given their value for targeted phishing, account recovery abuse, and identity-based fraud.

DoorDash has advised customers and partners to be wary of unsolicited communications that appear to originate from the company, to avoid clicking on unexpected links or attachments, and to review account security settings, including enabling strong, unique passwords and multi-factor authentication.

Sources: BleepingComputer, TechRepublic, TechRadar, Tom’s Guide

—

By the ID Tech Editorial Team