HackingTechnologyRetail & ConsumerInformationStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDCredentialsMediumContained

DOORDASH, INC.

bd_51f538b02aa638c6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 4, 2019

Filed

Sep 26, 2019

To disclose

21 weeks

Affected

21state residents only

Linked

5 filings

Confidence

66%

Full breach record for DOORDASH, INC. →

DoorDash notified Montana residents that an unauthorized third party accessed user data on May 4, 2019, via a third-party service provider. Compromised data included names, driver's license numbers, emails, phone numbers, DOBs, and hashed passwords. DoorDash engaged forensic experts, enhanced security, and offered identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 weeks / 145 days

May 4, 2019

Begins

May 4, 2019

Discovered

Sep 26, 2019

Filed

vs. sector median

+2 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_05cc94ac4e136a232019-09-26Verified
Washington State AGbd_9c1afd7d0ba186822019-09-26Verified by operator
New Hampshire State AGbd_175bc3b4b6791f752019-09-27 · +1dVerified
California State AGbd_aef90a7ba6bb5be52019-09-27 · +1dVerified

Name: DOORDASH, INC.
norm: doordash

Name: DOORDASH, INC.
norm: doordash
Industry: TechnologyllmRetail & Consumerllm

Discovered: May 4, 2019
Breach occurred: May 4, 2019
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 21state-resident count only
Data types: Identity (basic)Government IDCredentials
Data elements: Date of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Initial access: trusted_relationship

During the incident: Launched an investigation
Outside security experts was engaged to assess what occurred
Block further access by the unauthorized third party
Enhance security across our platform
Offering MyIDCareTM identity theft protection services
Encouraging all users whose information was involved to reset their passwords
Changes made: Adding additional protective security layers around the data
Improving security protocols that govern access to our systems
Bringing in outside expertise to increase our ability to identify and repel threats
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(145 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGSep 26 · first

Washington State AGSep 26 · first

Montana State AGSep 26 · first · this page

New Hampshire State AG+1d

California State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 26, 2019
Raw hash: fe44fbcb3b3ca0b299524a74e349e3098509f14943b1b8c2b93a33db4a0be5d0

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityDOORDASH, INC.

Victim entityDOORDASH, INC.

Incidentdiscovered May 4, 2019

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov