Thieves order a tasty takeout of names and addresses from DoorDash

DoorDash disclosed a data breach on 25 October 2025 after an employee fell for a social engineering attack that allowed attackers to gain account access. According to DoorDash, the information stolen varied by user and included names, phone numbers, email addresses, and physical addresses.

The company noted that it notified customers on 13 November 2025, about three weeks after discovery, and that it has since told law enforcement, added more employee training and awareness, hired a third party to assist with the investigation, and deployed improvements to its security systems to help prevent similar breaches. It has also faced criticism for insisting that “no sensitive information was accessed,” a claim some customers challenge, given the exposure of the above data.

The breach highlights how personal data beyond payment details—such as names and addresses—can be at risk in social engineering attacks, prompting calls for faster notifications and stronger disclosures.