DoorDash data access via phished third-party vendor credentials
DoorDash disclosed on August 25, 2022 that attackers used credentials stolen from employees of a third-party vendor in a phishing attack to reach some DoorDash internal tools. Customer and driver contact data was exposed. DoorDash tied the incident to the same campaign that hit Twilio, and disabled the vendor's access.
- Victim
- DoorDash
- Industry
- Retail and e-commerce
- Country
- United States
- Intrusion began
- Aug 2022
- First disclosed
- Aug 25, 2022
- Actor
- 0ktapus (linked by DoorDash to the Twilio campaign) (Financially motivated)
- Initial access
- Third-party access
- Identity control that failed
- Authorization
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Vendor accounts into internal tools need the same phishing-resistant MFA and least-privilege scoping as employee accounts.
Sources
- Twilio hackers also breached the food delivery firm DoorDash, Security Affairs, Aug 26, 2022
- DoorDash says data breach at third-party vendor exposes personal data of customers and employees, Bitdefender, Aug 26, 2022
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- LAPSUS$ access to Okta support via Sitel engineer workstation 2022 · Third-party access
- Nobelium abuse of reseller delegated administrative privileges 2021 · Third-party access
- Stolen ConnectWise app credentials open Microsoft 365 tenants across MSP customers 2026 · Third-party access
- Danish CPR register queried through a private company's abused access 2026 · Third-party access
Cite this record
SWI Community Team. (2026). DoorDash data access via phished third-party vendor credentials. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2022-doordash-vendor-phishing/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.