DoorDash Breach Exposes 367K Customer Records via Phished Third‑Party Vendor
What Happened — In August 2022 DoorDash disclosed that a third‑party vendor it relied on was compromised through a phishing campaign. Attackers accessed the vendor’s systems and extracted 367,476 DoorDash customer records, including email addresses, names, post codes and partial credit‑card data (brand, expiry month, last four digits).
Why It Matters for Trust & Control Assurance
- The incident illustrates the exact scenario a continuous control‑assurance program seeks to prevent: a supply‑chain partner becoming the weak link in data protection.
- Demonstrating ongoing vendor‑risk monitoring, documented due‑diligence, and a defensible audit trail is essential to satisfy control objectives around third‑party oversight.
- Mapping this breach to the Vendor Oversight control area provides evidence that your organization can meet multiple framework requirements (e.g., NIST CSF 2.0) with a single, well‑documented control.
Who Is Affected – Retail & e‑commerce platforms that use third‑party services for payment processing, logistics, or customer data handling.
Recommended Actions
- Initiate a formal review of all third‑party contracts and security attestations.
- Verify that vendors enforce phishing‑resistance training and multi‑factor authentication for privileged accounts.
- Collect and retain evidence of vendor‑risk assessments to support audit readiness and continuous monitoring.
Source: Have I Been Pwned – DoorDash breach
Technical Notes
- Attack vector: Phishing campaign targeting a vendor’s employees.
- Exposed data: Email addresses, names, geographic locations (post codes), and partial credit‑card details (brand, expiry, last four digits).