Food delivery giant DoorDash confirmed a data breach in a statement issued Wednesday, disclosing that an undisclosed number of customers had personal information stolen after attackers compromised a third-party vendor through a sophisticated phishing campaign. Stolen vendor employee credentials were used to reach DoorDash internal tools, exposing customer names, email addresses, delivery addresses, phone numbers, and partial payment card numbers, along with a separate set of driver records. The incident places DoorDash among a string of recent intrusions against major consumer platforms.
What Happened
According to the company, the intrusion did not begin inside DoorDash. Attackers targeted a third-party vendor with a phishing campaign that DoorDash characterized as sophisticated. Employees at that vendor had their credentials stolen, and those credentials were then used to access DoorDash internal tools.
DoorDash said it discovered "unusual" activity and responded by cutting off the third-party vendor's access to its systems. The company has not published a customer count, a dwell time, or a date range for the unauthorized access, which leaves the true scope of the compromise unresolved at the time of writing.
The pattern is a familiar one: a trusted supplier holds legitimate access into a much larger platform, and the credentials backing that access become the shortest path in. No malware, no exploit chain, no zero-day required.
What Was Taken
For customers, DoorDash confirmed the following data was stolen:
- Names
- Email addresses
- Delivery addresses
- Phone numbers
- Partial payment card numbers
For DoorDash drivers, attackers accessed:
- Names
- Phone numbers
- Email addresses
Volume remains undisclosed. On sensitivity, this is not a credential dump, and partial card numbers alone are not directly monetizable for card-present or card-not-present fraud. The delivery address field is the item defenders should focus on. Combining a verified home address with a verified name, phone number, and email address produces an identity package with real-world physical implications, not just financial ones. That combination supports high-confidence social engineering, SIM swap groundwork, doxxing, stalking, and physical targeting in a way that a leaked password hash does not.
Partial card numbers also serve a specific purpose in follow-on fraud. A caller who can recite the last four digits of a victim's card sounds like a bank. That is exactly the pretext material phishing operators want.
Why It Matters
Three things make this incident worth the attention of defenders outside the food delivery sector.
First, the initial access vector was a vendor, not DoorDash. Organizations routinely spend heavily on internal phishing resistance while extending broad tooling access to suppliers whose security posture they cannot see, cannot test, and do not monitor. The attacker in this case did not need to beat DoorDash's controls. They needed to beat the weakest supplier holding a key.
Second, the credentials worked. Stolen vendor credentials were sufficient to reach DoorDash internal tools, which means the authentication path for that vendor was survivable by credential theft alone. Phishing-resistant authentication, or even conditional access tied to device posture, changes that calculus materially.
Third, the exposed data set is optimized for the next attack rather than for immediate cash-out. Names, addresses, phone numbers, and partial card digits are raw material for convincing impersonation of DoorDash, of banks, and of delivery services. Organizations in the same consumer ecosystem should expect an uptick in fraud attempts referencing legitimate DoorDash order details, because the attackers now have them.
The broader wave of attacks against major consumer platforms suggests this is not an isolated targeting decision. Consumer platforms aggregate exactly the kind of verified identity data that makes downstream social engineering work at scale.
The Attack Technique
The chain, as described by DoorDash, breaks into four stages:
- Phishing against a third party. Attackers ran what DoorDash called a sophisticated phishing campaign against a vendor rather than against DoorDash directly.
- Credential theft. Vendor employees surrendered working credentials. DoorDash has not stated whether multi-factor authentication was in place, bypassed, or absent, which is the single most important unanswered technical question in this disclosure.
- Lateral use of legitimate access. Those credentials were used to access DoorDash internal tools. The activity would have looked like authorized vendor usage until behavior deviated from baseline.
- Detection and containment. DoorDash identified unusual activity and revoked the vendor's system access.
This maps cleanly to well-documented tradecraft: phishing for initial access, valid accounts for persistence and defense evasion, and access to internal support or administrative tooling for bulk data collection. Internal tools that expose customer records at scale are a high-value objective precisely because they are designed to answer "show me this customer's details" quickly and repeatedly.
What Organizations Should Do
Inventory every third party with access to internal tooling. Produce a current list of vendors, the specific systems they touch, the accounts they use, and the business owner accountable for each. Most organizations discover the list is longer and staler than expected.
Require phishing-resistant MFA for all vendor accounts. Hardware security keys or platform passkeys defeat credential phishing outright. SMS and app-based push codes do not reliably survive a modern adversary-in-the-middle phishing kit.
Scope vendor access to the minimum record set and enforce rate limits. A support vendor rarely needs unbounded query capability against the full customer database. Cap bulk reads, and require justification or ticket linkage for high-volume lookups.
Baseline and alert on vendor account behavior. Alert on new source geographies, new devices, off-hours activity, and query volume spikes per vendor account. DoorDash's own detection came from "unusual" activity, which validates the control; the goal is to trip that wire earlier.
Prepare for downstream social engineering now. Brief support and fraud teams that attackers may hold verified customer names, addresses, phone numbers, and partial card digits. Update verification scripts so that reciting those details is not treated as proof of identity.
Contractually require breach notification timelines from vendors. Include defined notification windows, log preservation obligations, and the right to audit authentication controls. Access revocation should be a one-step operation your team can execute unilaterally.
For DoorDash customers, the practical guidance is to treat unsolicited calls, texts, or emails referencing recent orders as hostile by default, to never confirm card digits or account details to an inbound caller, and to watch card statements for unrecognized activity.
Sources: DoorDash data breach leaves important customer details exposed