Breach taxonomy
Summary
In October 2025, DoorDash identified a cybersecurity incident in which an employee was targeted by a social engineering scheme that enabled an unauthorized third party to gain access to certain internal systems and obtain limited contact information for a mix of users, including merchants, consumers, and Dashers. DoorDash devoted significant resources to investigation, remediation, and notification. The company determined the incident did not have a material impact on its business, results of operations, or financial condition. Disclosed in annual 10-K; company determined the incident was not material.
Tagging rationale
ThreatUnknown
Filing does not attribute the incident to a specific actor category -> UNKNOWN.
MethodsData ExfilAccount TakeoverPhishing
An employee was targeted by a social engineering scheme (PHISHING) that enabled the attacker to take over access to internal systems (ACCOUNT-TAKEOVER) and extract user contact information (DATA-EXFIL).
AssetsPersonal Data
Filing states 'limited contact information relating to a mix of users, including merchants, consumers, and Dashers' was obtained -> PERSONAL-DATA.
EffectsInfo Privacy Loss
Contact information for platform users was obtained by an unauthorized third party -> INFO-PRIVACY-LOSS.
Impact
Limited contact information only, no financial or operational impact, company explicitly determined the incident was not material -> score 1.
InsuranceNot disclosed
Filing makes no mention of insurance in connection with this incident -> null.
Read the original SEC filing excerpt
in October 2025, we identified and disclosed a cybersecurity incident in which an employee was the target of a social engineering scheme that enabled an unauthorized third party to gain access to certain internal systems and obtain limited contact information relating to a mix of users, including merchants, consumers, and Dashers that use our platform. Although we determined that this incident did not have a material impact on our business, results of operations, or financial condition, it required us to devote significant time and resources to investigation, remediation, and notification, and underscores the ongoing risks posed by these and other schemes.