DoorDash user contact data taken after an employee was socially engineered
DoorDash began notifying users on November 13, 2025 that an unauthorized party had accessed internal systems after an employee fell for a social engineering scam, a problem it identified on October 25. Exposed data varied by person and included names, email addresses, phone numbers and physical addresses; DoorDash said no Social Security numbers, government IDs or payment data were accessed.
- Victim
- DoorDash
- Industry
- Retail and e-commerce
- Country
- United States
- Intrusion began
- Oct 25, 2025
- First disclosed
- Nov 13, 2025
- Actor
- Unattributed
- Initial access
- Credential phishing
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
One tricked employee opened access to contact data across customers, couriers and merchants. Phishing-resistant MFA and narrower data access per role are the controls.
Sources
- DoorDash confirms serious data breach - customer names, addresses, emails are more all leaked, here's what we know, TechRadar, Nov 14, 2025
- DoorDash suffers data breach after social engineering attack on employee, CyberInsider, Nov 14, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- ASOS customer data reached with an employee login obtained by impersonation 2026 · Credential phishing
- Dexcom internal documents accessed after targeted vishing 2026 · Credential phishing
- RingCentral customer data stolen after a social engineering attack 2026 · Credential phishing
- Mixpanel smishing breach exposes OpenAI API user data 2025 · Credential phishing
Cite this record
SWI Community Team. (2026). DoorDash user contact data taken after an employee was socially engineered. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2025-doordash-employee-social-engineering/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.