The people affected joined DoorDash on or before April 5, 2018 — people who joined after that date weren’t affected, according to the blog post. The company said it will be notifying those who were.
The breach involved data such as names, email addresses, delivery addresses, order history, phone numbers and encrypted versions of passwords. In some instances, the last four digits of payment cards and bank account numbers were accessed. According to the blog post, full payment card and bank account information weren’t compromised. The driver’s license numbers of about 100,000 delivery people were also accessed.
In response to the breach, DoorDash said it has added more security layers to protect people’s data and improved the security protocols required to gain access to this data.
DoorDash encouraged people to change their passwords, even if they weren’t affected but were still concerned about the safety of their accounts.