HackingTechnologyTransportation & LogisticsInformationStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountCredentialsHighContained

DOORDASH, INC.

bd_aef90a7ba6bb5be5 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 5, 2019

Filed

Sep 27, 2019

To disclose

22 days

Affected

41,740state residents only

Linked

5 filings

Confidence

65%

Full breach record for DOORDASH, INC. →

DoorDash, Inc. reported that an unauthorized third party accessed user data via a third-party service provider on May 4, 2019. The company became aware of the incident on September 5, 2019. Affected data included names, email addresses, phone numbers, hashed/salted passwords, and in some cases, the last four digits of payment cards or bank accounts. For some Dashers, driver's license numbers were also accessed. Approximately 41,740 California residents were affected. DoorDash engaged outside security experts, blocked access, and enhanced security protocols. Complimentary identity theft protection was offered to affected Dashers.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 5, 2019 → Notified Sep 26, 201921d ✓ CA 60-day OK22 days discovery → filing

Incident timeline

undetected · 124 days

discovery → filing · 22 days

May 4, 2019

Begins

Sep 5, 2019

Discovered

Sep 27, 2019

Filed

vs. sector median

16 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_175bc3b4b6791f752019-09-27Verified
Massachusetts State AGbd_05cc94ac4e136a232019-09-26 · +1dVerified
Montana State AGbd_51f538b02aa638c62019-09-26 · +1dCandidate
Washington State AGbd_9c1afd7d0ba186822019-09-26 · +1dVerified by operator

Name: DOORDASH, INC.
norm: doordash

Name: DOORDASH, INC.
norm: doordash
Industry: TechnologyllmTransportation & Logisticsllm

Discovered: Sep 5, 2019
Breach occurred: May 4, 2019
Undetected for: 124 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 26, 2019
Affected individuals: 41,740state-resident count only
Data types: Identity (basic)Government IDFinancial accountCredentials
Data elements: Date of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Third party: via third-party service provider
Initial access: supply_chain

During the incident: Launched an investigation
Engaged outside security experts
Blocked further access by the unauthorized third party
Enhanced security across its platform
Providing notification via email and United States Postal Service First-Class mail
Issuing a press release and posting notice on its website
Providing a telephone number for individuals to call with any questions
Offering Dashers whose driver’s license numbers were involved complimentary one-year memberships to ID Experts MyIDCare
Changes made: Adding additional protective security layers around the data
Improving security protocols that govern access to its systems
Bringing in outside expertise to increase its ability to identify and repel threats
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: CA 60-day OK · 21d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 5, 2019
→ Notified: Sep 26, 2019
21d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 5, 2019 → Notified: Sep 26, 2019	21d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGSep 26 · first

Montana State AGSep 26 · first

Washington State AGSep 26 · first

New Hampshire State AG+1d

California State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-150916
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 27, 2019
Raw hash: de45a4d273ba01e579d1702bd3fdcbec44d29cb1ead1a6ec71525dea3dbd1c92

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityDOORDASH, INC.

Victim entityDOORDASH, INC.

Incidentdiscovered Sep 5, 2019

Stated responseLaunched an investigation

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov