HackingTechnologyRetail & ConsumerInformationStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountCredentialsMediumContained

DOORDASH, INC.

bd_175bc3b4b6791f75 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 5, 2019

Filed

Sep 27, 2019

To disclose

22 days

Affected

86state residents only

Linked

5 filings

Confidence

64%

Full breach record for DOORDASH, INC. →

DoorDash Inc. notified the NH AG of a breach involving a third-party service provider. Unauthorized access occurred on May 4, 2019, affecting user data including names, emails, hashed passwords, and last 4 digits of payment info. Driver's license numbers were accessed for some Dashers. 86 NH residents affected. Notifications began Sept 26, 2019.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 124 days

discovery → filing · 22 days

May 4, 2019

Begins

Sep 5, 2019

Discovered

Sep 27, 2019

Filed

vs. sector median

8 wks faster

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_aef90a7ba6bb5be52019-09-27Verified
Massachusetts State AGbd_05cc94ac4e136a232019-09-26 · +1dVerified
Montana State AGbd_51f538b02aa638c62019-09-26 · +1dCandidate
Washington State AGbd_9c1afd7d0ba186822019-09-26 · +1dVerified by operator

Name: DOORDASH, INC.
norm: doordash

Name: DOORDASH, INC.
norm: doordash
Industry: TechnologyllmRetail & Consumerllm

Discovered: Sep 5, 2019
Breach occurred: May 4, 2019
Undetected for: 124 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 26, 2019
Affected individuals: 86state-resident count only
Data types: Identity (basic)Government IDFinancial accountCredentials
Data elements: Date of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: supply_chain

During the incident: Launched an investigation
Engaged outside security experts
Blocked further access by the unauthorized third-party
Enhanced security across its platform
Issued a press release
Posted notice on its website
Provided a telephone number for individuals to call
Offered complimentary one-year memberships to ID Experts MyIDCare
Changes made: Adding additional protective security layers around the data
Improving security protocols that govern access to its systems
Bringing in outside expertise to increase its ability to identify and repel threats
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGSep 26 · first

Montana State AGSep 26 · first

Washington State AGSep 26 · first

California State AG+1d

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/doordash-20190927.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 27, 2019
Raw hash: 69333388c41e88e34c9c10eaa0af3750d8252cf85a20eb92c9078fcfddf6c09b

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityDOORDASH, INC.

Victim entityDOORDASH, INC.

Incidentdiscovered Sep 5, 2019

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov