25 ms·
DoorDash confirms data breach affected 4.9M customers, workers and merchants
- big_chungus 7y agoOriginal blog post: https://blog.doordash.com/important-security-notice-about-your-doordash-account-ddd90ddf5996#46h35gr24e https://blog.doordash.com/important-security-notice-about-yo... From the techcrunch article: "It’s not clear why it took almost five months for DoorDash to publicly reveal the breach. DoorDash spokesperson Mattie Magdovitz say why [sic]." Pretty bad. If personal identity info is exposed, it is irresponsible not to notify users immediately so they can freeze credit and watch for suspicious activity. The blog post did mention a third-party vendor, so it's possible there was a delay, but it's a whole other problem if it took this long to find a breach. This sounds like it could be "flipboard-itis". Flipboard stored passwords insecurely in the beginning (SHA-1), but switched to bcrypt as it scaled. The passwords breached were before 2015, so possibly a similar thing here where they started out with bad security and improved with scale (but left the old stuff behind). I'm guessing Doordash did something similar and improved security as it scaled.
- tempsy 7y agoHuh? The blog post says April 5, 2018.
- deleted 7y ago[deleted]
- Deimorz 7y agoI'm not sure what you're trying to point out, but it seems like the data was stolen from a third party DoorDash uses, and that they only had data from users that registered on or before April 5, 2018. The breach actually happened on May 4, 2019. (And the 2015 reference in the comment you're replying to is about a Flipboard breach, not DoorDash)
- rickyc091 7y agoWell, back in 2018, TechCrunch reported that they were compromised. I believe this is the same breach as then. They just reported it one year later. https://techcrunch.com/2018/09/25/doordash-customers-say-their-accounts-have-been-hacked/ https://techcrunch.com/2018/09/25/doordash-customers-say-the...
- bin0 7y agoThey really should have given some actual information, i.e. how the information was stored. I want to know what algorithm was used, not how "it was securely stored so people still can't take your money" or some other corporate-speak intended to mitigate the damage.
- luhn 7y agoThe official blog post: https://blog.doordash.com/important-security-notice-about-your-doordash-account-ddd90ddf5996#46h35gr24e https://blog.doordash.com/important-security-notice-about-yo...
- Nextgrid 7y agoI feel bad for the people affected but at least the scummy company got what it deserved for stealing tips (for those unaware, they used to withhold the total tips out of a delivery drivers base compensation so essentially taking the tips for themselves). Now if they could just completely die so a more ethical competitor can take its place it would be even better.
- deleted 7y ago[deleted]
- SomaticPirate 7y agoYeah the Equifax breach was the nail in the coffin for them... Data breaches rarely hurt companies it seems.
- Nextgrid 7y agoEquifax's story is different, people don't have a choice whether to use them (if people did they'd already be out of business) and they have a near-monopoly, not to mention they are profitable so they are here to stay. Doordash? They're just a shitty startup trying to "disrupt" the market by forgetting laws and morals and are only surviving thanks to VC money. People are not obliged to use them, and since they're essentially providing a commodity people can easily choose to use a competitor, only accelerating Doordash's inevitable demise. People aren't always reasonable, and such incidents can sway them towards other competitors (even though I doubt the competitors are any better in terms of security).
- hollerith 7y agoWhat product or service do you believe that Equifax is near being a monopoly provider for?
- Nextgrid 7y agoCredit reference agency? Okay there are 3 of those, but given that pretty much every single financial institution both queries and reports to all 3 they all have a monopoly and neither is going away.
- SketchySeaBeast 7y agoI still worry about DoorDashes security - someone has signed up for services with my email account - not an issue, I just will never verify them. But they had signed up for DoorDash, and I didn't realize it, and then I tried to sign up for the first time via the Android App with that same email account. I selected the email account to my surprise it immediately let me into the other persons account! They had ostensibly set up a password, but I didn't need it and could see their phone number and bits of their payment information. I sent in a support email for that one, and got the account closed, but still, not a great sign.
- xxxtentachyon 7y agoI don't understand, it just never prompted you for a password?
- SketchySeaBeast 7y agoNope. I was using the built in Android Account linking (like if you link up your Facebook account to an application OAuth style), but the person who set up the account couldn't have been - they would have set it up with a password as they can't access my email account. Of note here, I never verified the account when the user first signed up, so DoorDash has always just been going on the first guy's word that they are who they say they are.
- deleted 7y ago[deleted]
- gtCameron 7y agoIf you control the email address on the account you could get in by resetting the password, so I'm not sure what the difference is there
- deleted 7y ago[deleted]
- 7y ago
- cj 7y ago> The information accessed is not sufficient to make fraudulent charges on your payment card. In other words... "We leaked a bunch of your personal information, but at least it's not enough data to steal your money!" All of these leaks have the cumulative effect of making ineffective very commonly used security verification questions: "Can I verify that last 4 of your social? And the last 4 of your credit card?" How long will it take for us to accept that this kind of data can no longer be assumed private? The sooner, the better, mainly so companies stop using it as a secondary form of identity verification.
- paxys 7y agoYeah. In fact reversing a fraudulent credit card charge is a LOT easier than dealing with identity theft or stalkers.
- boobePhuu7iet7i 7y agoBut now they have a dump of how many peoples names, address and phone numbers?
- hombre_fatal 7y agoLeaking is only part of the problem. The main issue is that this information lets you authenticate with anything at all or as a starting point for social engineering. For example, you could build your own database of millions of records of name/phone/addr just looking up WHOIS info on every domain name you come across. And I'm reminded of how you can get into someone's Amazon account by feeding WHOIS information to their customer support, even if the address is bogus but is in the same city that Amazon has on file. https://medium.com/@espringe/amazon-s-customer-service-backdoor-be375b3428c4 https://medium.com/@espringe/amazon-s-customer-service-backd... HN takes out its pitch forks for every leak, but the outrage is often misdirected. For example, why do we have this idiotic system where you can make purchases on my credit card with the same credentials I hand out multiple times a day, even for a $5 hotdog, and as a result I need to remain eternally vigilant to find fraud on my monthly statements? Why can you get into my Amazon account if you know a single address that approximates one of the addresses I've ever shipped product to? Leaking is inevitable. The problem is that our system and thus our expectations are built as if it's not.
- standardUser 7y agoAt this point HN should just have a permanent module in the top right corner announcing the latest data breach.
- quickthrower2 7y agoBreaking news: There is someone who has been walkabout living in the woods since 2000, and nobody has his data!
- reaperducer 7y agoI know you're joking, but I have a relative like this. Owns a huge swath of land someplace remote. Only deals in cash. (His special skills are such that his employer gladly pays him in cash.) Doesn't trust cars with electronics, so he builds his own motorcycles to get around. As far as I know, the only record of him existing is property tax and income tax. I went to visit once, and he doesn't even have a mailbox. I assume he has a PO Box somewhere. He built his own house. It's not a very good house, but it's good enough for him and his wife. The only electronics he has is a TV that runs off of some kind of tiny water mill in the creek. It only gets over-the-air channels. I guess he's happy, but it's not the kind of happiness I could bear. He also seems to have lost all interest in shaving.
- glouwbug 7y agoEquifax has his data probably lol
- JohnJamesRambo 7y agoImagine being afraid of car electronics and choosing a motorcycle as your safe method of transport.
- judge2020 7y agoYa, some pre-2010 car should be perfect.
- 7y ago
- dx87 7y agoThe official blog post doesn't give any information about the breach except "We noticed a third-party had unauthorized access to DoorDash data", and the TechCrunch article says that DoorDash responded that they couldn't explain how the breach happened. How are they so sure that they fixed the underlying cause if they don't even know how the third-party got access in the first place?
- not_a_cop75 7y ago"couldn't explain" = Were too embarrassed to explain... or could expose themselves to several lawsuits by revealing.
- Deimorz 7y agoIt seems like the breach was through a third party that only had old data, since nobody that registered after April 5, 2018 is affected. So it's probably some service that they no longer use and doesn't really need to be fixed or investigated, since all the data they had has already been taken and they (probably) stopped giving them more data a year and a half ago. They should really say who the third party was though. Hopefully that information comes out.
- bowties2cool 7y agoA year ago customers were complaning that their accounts were accounted despite using an unique password to DoorDash. DoorDash at that time denied any hacking incidents. A more sinister explanation is that DoorDash knew back then who is leaking their data and removed their access. But chose to disclose only just now.
- luckydata 7y agowhen will it become not ok to suck at this?
- deleted 7y ago[deleted]
- frereubu 7y agoI don't know a great deal about DoorDash, but my understanding is that they're only in the US. If so, they're not bound by the EU's GDPR data breach disclosure timescales, which are "without undue delay and, where feasible, not later than 72 hours" if they're likely to result in a high risk to the rights and freedoms of data subjects, which this seems to fit. Compare that with the apparent five month delay here, with all its attendant risks to the customers whose data was made available. The EU has its flaws, but when I read stories like this I'm really happy I'm covered by GDPR.
- jacquesm 7y agoThere is a silver lining in all these data breaches. At some point in time all our data will have been leaked at least once and probably more than once and subsequent leaks will not do any more damage. The safe assumption would then be to not trust any accounts created online without some good old KYC processes in place requiring live verification of identity.
- roemance 7y agoTotally agree! As a bit of self-promotion, my company (Berbix) is trying to solve this by automating ID checks and being the best possible stewards of this sensitive data: http://berbix.com http://berbix.com We've gone to great lengths to secure ID and DL information and have even built a watermarking service to track all access to these images: https://docs.berbix.com/docs/transactions#section-watermarking https://docs.berbix.com/docs/transactions#section-watermarki...
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- basicplus2 7y agoA government created physical token for every person could be the direction we are headed
- adtac 7y ago>The breach happened on May 4 I don't believe for one second that they didn't know about it for five months! Can someone in the EU please report this so that it's investigated for a GDPR violation? Edit: from the official post on blog.doordash.com: >Earlier this month, we became aware of unusual activity involving a third-party service provider. Of course. This is quite a bit more than the 72 hour window GDPR allows.
- treggle 7y agoIs there a list of all disclosed security breaches somewhere?
- nvr219 7y agoNo
- rogerbinns 7y agohttps://haveibeenpwned.com/PwnedWebsites https://haveibeenpwned.com/PwnedWebsites There is even an RSS feed. It doesn't cover every breach but certainly significant verified ones - details in the site FAQ. There is even such a thing as faked breaches!
- Sneeza 7y agoThe best site I've used is haveibeenpwned.com, seems to be the go-to for most security breaches and has a tool that can notify you when some of your information has been compromised tied to an email address.
- rolltiide 7y agoI don't like that because if you put in an email address it doesn't reveal whether you've already addressed the issue or not. It just shows if it was included in a breach, great for newbs to go "ooOOOooooOOoo" but useless for anything else. I also alias email addresses for every service that allows a + sign in the email field, so now I have no way to notice quickly if the email was included in a leak. But I do have a way to know which service got breached or sold info if I start getting additional emails to any particular alias.
- truthwhisperer 7y agonice so in a few weeks i get an indian scammer on the line: g'day sir wanne try this pizza very cheap only for you
- seomint 7y agoI don't know what's more frustrating to read -- news of these seemingly constant data breaches or news that the latest Windows 10 Update just broke something else.
- hnruss 7y agoWonder if I'll get another $25-50 from a class action lawsuit over this.
- munk-a 7y agoNah, you'll be offered 25-50$ but then they'll swap it out for 25-50$ in credit monitoring and/or applebee's coupons at the last minute.
- dylan604 7y agoI think I take the credit monitoring in this instance?
- magashna 7y agoI'll throw it on the pile of all the other credit monitoring I've gotten from other breaches.
- munk-a 7y agoSadly credit monitoring just increases the chance that your data will be breached once again - what about the option where, because you guys done goofed with my data, you're not allowed to track me anymore or store any data on me - and you're not allowed to charge me to do this nor randomly charge me if a bank tries to talk to you. Credit Bureaus are just such steaming piles of crap.
- situational87 7y agoI can't wait for the FTC to issue a statement, it will be something like: "Applebee's Coupons are clearly the best value for consumers, from savory appetizers to desserts with a kick, you're going to want to take that delicious settlement!"
- thoughtpalette 7y agoAnyone know how this affects users that login via Facebook Auth with Doordash?
- noodlesUK 7y agoOnce again, the US is sorely lacking regulation w.r.t data breaches. In Europe the breach might have still happened but at least customers would have been told months earlier and there would be some predictable penalties for the companies. I also think that DoorDash would have been more transparent about the steps that lead up to this. We need a US GDPR. Even if there’s nothing like the right to be forgotten, we need data breach regs.
- rietta 7y agoThe classic trite "We take the security of our community very seriously." Nearly every corporate communication about a breach says it and often it comes out to have been demonstrably untrue.
- ohnope 7y agoIt's like the data breach version of "It's been an incredible journey!" after getting acquired. Someone should make a Tumblr for data breach marketing copy.
- rhizome 7y agoA sibling site of Our Incredible Journey could be SRS BSNS, with statements by companies to that effect.
- re 7y agoHere's a four-year-old collection: https://www.troyhunt.com/we-take-security-seriously-otherwise/ https://www.troyhunt.com/we-take-security-seriously-otherwis... > “We take security seriously”, otherwise known as “We didn’t take it seriously enough”
- greenail 7y agoI've been vending myself unique email addresses for every online account I use for about 3 years. They are nice because I can reply to them like a regular mail and my actual email account gets stripped out automagically. I've been considering making it a product and I wonder in this case what people would want to do when the account data gets leaked? 1. blackhole all email to the address. 2. forward all email to some email service that is never/rarely used. 3. flag messages that are not sent from the matching domain (doordash.com in this case). 4. blackhole and generate a new address so the user can go back to door dash and provide a fresh email address. I also wonder if there is any use for meta data on who's trying to email a blackholed email addrress e.g spam blacklisting.
- novok 7y agoYou can do something similar with fastmail. Get a domain for your email and make an alias address of the form [anything]@[alias].domain.com . You can then make 'sending identities' for an instance of that catchall domain for the rare time you need to send email as mortgage_company@a.domain.com . You can also create rules to blackhole a specific alias email or whatever you want when you need to invalidate the email.
- greenail 7y agoSo how would you handle this breach with your fastmail alias?
- novok 7y agoIf I start noticing annoying spam being sent to doordash@a.domain.com then I make an email rule to delete it and change my doordash account email to doordash_again@a.domain.com along with a password change with my password manager?
- munk-a 7y agoIt'd be nice if there was a way to way that pile of emails at some authority and say "Here, this is the crap that's come of that data breach." Ditto for any authorized (but shady) third party data sharing. Sadly we currently lack a consumer protection bureau.
- basicplus2 7y agoA government created physical token for every person could be the direction we are headed
- readhn 7y agoI propose a way to improve cybersecurity: FINE companies who loose sensitive customer data to hackers. Fines can be calculated according to the "breach severity grid" which is based on the type of data that is lost. For example: 1. Personal address, DOB - $15. 2. Each social security $20. 3. Driver license number $25. 4. Bank account numbers $30. etc. So a loss of 4.9 million social security numbers, DOB and addresses would generate a fine of $171,500,000 Problem solved! Now, the company will think 100x times BEFORE collecting consumer data if they can actually PROTECT IT. Build robust security FIRST!
- Sohcahtoa82 7y agoI would add passwords to the list of fines with growing penalties based on how the passwords were stored. Unique salt per user hash < shared salt with user hash < no salt but using strong hash < no salt and a weak algorithm like MD5 or SHA-1 < plaintext
- readhn 7y agogreat suggestion! loosing data that is well protected is one things, but loosing plain text personal info is totally different matter and should be punished more.
- PeterCorless 7y agoOkay, this has been up for two whole hours, and no one has yet said "OMG, I think I'm going to lose my lunch over this!" Get with it people! The jokes are right there.
- tolstoshev 7y agoDoorDash probably forgot to tip the “third-party service provider”
- dylan604 7y agoNo, they kept took their tip to pay the base salary instead.
- throwaway867295 7y ago(Throwaway account) I used to work for a third-party service provider that merchants send this sort of data to for lots of users. Considering there weren't lots of customers using this provider making similar posts, and Doordash didn't call out the provider, it wouldn't surprise me if a Doordash employee account with that provider got compromised. The blog post was carefully worded to not throw the provider under the bus, but also avoid taking blame, themselves. The telling bit is that the last four digits of credit card numbers were sent. There are only a few types of vendors you'd send that data to.
- jenrzzz 7y agoDoorDash is the worst. They inexplicably banned me from their platform after giving me a credit for a bad order. I filed several support tickets over several months and kept getting canned responses about how they were "looking into the issue." Eventually I just switched to Uber Eats.
- cavisne 7y agoDisclosure on this was pretty bad. I got an email saying your password has been reset, if you didnt do this contact support. Removed payment methods from my account and reset the password, but now I assume this was done to all users?
- DConway39 7y agoWow thats crazy
- mattbreeden 7y agoThis was great to get an email about since doordash does not let users delete accounts. You can only 'deactivate' in a way that is easy to 'reactivate'. If I would have actually been allowed to delete my account many months ago when I asked maybe I wouldn't have had my information leaked.
- mattacular 7y agoMy doordash got hacked a year ago when they did not have a special call center set up. I had no choice but to file a support ticket into the void (which was even more difficult since I did not have access to my account so I had to use a public contact form). I always suspected a breach since the account had a unique password and was only used on my personal phone which I was still in possession of. I wonder if they are just now getting around to disclosing that breach? I did not hear back from support for 3 months (no exaggeration). I asked that they delete my account back then so you can imagine my delight to receive more security-related correspondence from this company today.
- abuehrle 7y agoI received the email. I'd asked them to delete my account 6 months ago, and they confirmed at the time they'd "deactivated" it. I guess that wasn't enough to protect me. As an American developer, GDPR seemed like a pain at first, but more and more I wish we had something similar.
- sir_sagar 7y agoThis kind of bugs and problems will open the eyes of companies to get on to blockchain. As a Blockchian enthusiast, i found it is best to store data on it. And in market many companies doing the same too. to fire more questions and query drop a mail on sagar@trsts.co
- geocar 7y agoI'd like to point out, it's not "DoorDash" that has done anything wrong, it's these people: - Andy Fang - Evan Moore - Stanley Tang - Tony Xu They decided our security and privacy wasn't worth as much as hur hur hur growth hacking startup hur hur next uber, and couldn't be arsed to even give us a proper apology. Look at their blog post: not one mention of the words "we sorry, we fucked up". It's all about the other guys. The bad guys. The guys who stole your data not us, and you should change your password with us to protect your account with us. No. That's wrong. Look at the 295 million people who weren't affected -- all the people who don't use doordash at all! That means the best way to protect yourself is to simply not use doordash. Delete it. Delete the email account and the bank/credit card you used with them (ask your bank/credit card company for a new number). Move if you've got to (drivers license details!?!?!?) You have no other protection now- you're fucked. They have your data, and they're only going to risk it again. And remember how difficult it is to get in control of your data again when the next breach happens, the next time you're thinking about signing up with something, or you're getting ready to vote.
- WilliamEdward 7y agoCould not agree more. There's a tendency to not blame founders... but why? They created the product from the ground up. They had a choice on how to build security and chose the easy way out. They should be held to a higher standard given the power dynamics they have over the company and its users.
- deleted 7y ago[deleted]
- souterrain 7y agoThe founders are very busy devising wage theft schemes. How can they possibly spend time on security or apologies?
- paulddraper 7y ago> devising wage theft schemes Expand?
- louwrentius 7y agoA 490 million dollar fine sounds reasonable. To be paid by giving each customer back $100.
- zer0faith 7y agoWhen the F are we going to hold people accountable for piss poor security posture.
- newherehi 7y agoStealing tips and now a breach with a terrible response. These people should be in jail and their company should be shut down.
- accounn 7y agoconsent.yahoo.com/consent to be being spied on.
- oldspleen 7y agoThere goes my private data. Thank you DoorDash for the leak.
- oldspleen 7y agoThere goes my private data; thanks doordash for the leak
- Thriptic 7y agoIs their password change function working? I can't seem to change my pw. It gets to SMS 2FA then appears to fail when I try to verify the token I'm sent and boots me back to the PW change page.
- innagadadavida 7y agoAfter using food delivery and takeout services, I felt the plastic waste it generates is incredible. All the folks that care even a little bit about the environment, please just get out of your homes and just dine-in. Silicon Valley startups just don’t care about the environment, you can change that one person at a time.
- rkho 7y agoI attempted to purge my data from Doordash's servers. They refused, citing GDPR for some reason and saying the best they could do was to "deactivate" my account (while retaining my personal information).