HackingTechnologyInformationStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedAuthenticationCredentialsFinancial accountIdentity (basic)Government IDHighContained

DOORDASH, INC.

bd_9c1afd7d0ba18682 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 5, 2019

Filed

Sep 26, 2019

To disclose

21 days

Affected

2,243state residents only

Linked

5 filings

Confidence

71%

Full breach record for DOORDASH, INC. →

DoorDash Inc notified Washington AG of unauthorized access to user data via a third-party service provider. Access occurred May 4, 2019; discovered Sept 5, 2019. Data included names, emails, hashed passwords, and driver's licenses for some Dashers. 2,243 Washington residents notified. Remediation included enhanced security layers and protocols.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 124 days

discovery → filing · 21 days

May 4, 2019

Begins

Sep 5, 2019

Discovered

Sep 26, 2019

Filed

vs. sector median

16 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_05cc94ac4e136a232019-09-26Verified
Montana State AGbd_51f538b02aa638c62019-09-26Candidate
New Hampshire State AGbd_175bc3b4b6791f752019-09-27 · +1dVerified
California State AGbd_aef90a7ba6bb5be52019-09-27 · +1dVerified

Name: BakerHostetler LLP
norm: bakerhostetler

Name: DOORDASH, INC.
norm: doordash
Industry: Technologyllm

Discovered: Sep 5, 2019
Breach occurred: May 4, 2019
Undetected for: 124 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 26, 2019
Affected individuals: 2,243state-resident count only
Data types: AuthenticationCredentialsFinancial accountIdentity (basic)Government ID
Data elements: NameDriver's licence numberUsername + passwordDate of birth
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 100-199dexposure 0d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Office of the Washington Attorney General
Initial access: supply_chain

During the incident: Launched an investigation
Outside security experts were engaged to assess what occurred
Block further access by the unauthorized third-party
Enhance security across its platform
Providing notification via email with a copy sent via United States Postal Service First-Class mail
Providing a telephone number for individuals to call with any questions
Offering Dashers whose driver’s license numbers were involved complimentary one-year memberships to ID Experts® MyIDCareTM
Changes made: Adding additional protective security layers around the data
Improving security protocols that govern access to its systems
Bringing in outside expertise to increase its ability to identify and repel threats
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGSep 26 · first

Montana State AGSep 26 · first

Washington State AGSep 26 · first · this page

New Hampshire State AG+1d

California State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10511.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 26, 2019
Raw hash: 05443447c20f33815b2d390d1fc99464d17bbeae4b1ca7a961b3b05b080e788d

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityBakerHostetler LLP

Victim entityDOORDASH, INC.

Incidentdiscovered Sep 5, 2019

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com