Breach taxonomy
Summary
In October 2025, DoorDash identified a cybersecurity incident in which an employee was targeted by a social engineering scheme that enabled an unauthorized third party to gain access to certain internal systems and obtain limited contact information for a mix of users, including merchants, consumers, and Dashers. DoorDash devoted significant resources to investigation, remediation, and notification. The company determined the incident did not have a material impact on its business, results of operations, or financial condition. Disclosed in annual 10-K; company determined the incident was not material.
Tagging rationale
ThreatUnknown
Filing does not attribute the incident to a specific actor category -> UNKNOWN.