DoorDash confirms data breach affected 4.9M customers, workers and merchants
1–10 of 224 posts
Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants
#2Original blog post: https://blog.doordash.com/important-security-notice-about-yo...
From the techcrunch article: "It’s not clear why it took almost five months for DoorDash to publicly reveal the breach. DoorDash spokesperson Mattie Magdovitz say why [sic]."
Pretty bad. If personal identity info is exposed, it is irresponsible not to notify users immediately so they can freeze credit and watch for suspicious activity. The blog post did mention a third-party vendor, so it's possible there was a delay, but it's a whole other problem if it took this long to find a breach.
This sounds like it could be "flipboard-itis". Flipboard stored passwords insecurely in the beginning (SHA-1), but switched to bcrypt as it scaled. The passwords breached were before 2015, so possibly a similar thing here where they started out with bad security and improved with scale (but left the old stuff behind). I'm guessing Doordash did something similar and improved security as it scaled.
Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants
#3The official blog post: https://blog.doordash.com/important-security-notice-about-yo...
Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants
#4Original blog post: https://blog.doordash.com/important-security-notice-about-yo... From the techcrunch article: "It’s not clear why it took almost five months for DoorDash to publicly reveal the breach. DoorDash spokesperson Mattie Magdovitz say why [sic]." Pretty bad. If personal identity info is exposed, it is irresponsible not to notify users immediately so they can freeze credit and watch for suspicious activity…
Huh? The blog post says April 5, 2018.
Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants
#5Original blog post: https://blog.doordash.com/important-security-notice-about-yo... From the techcrunch article: "It’s not clear why it took almost five months for DoorDash to publicly reveal the breach. DoorDash spokesperson Mattie Magdovitz say why [sic]." Pretty bad. If personal identity info is exposed, it is irresponsible not to notify users immediately so they can freeze credit and watch for suspicious activity…
Huh? The blog post says April 5, 2018.
[deleted]
Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants
#6I feel bad for the people affected but at least the scummy company got what it deserved for stealing tips (for those unaware, they used to withhold the total tips out of a delivery drivers base compensation so essentially taking the tips for themselves).
Now if they could just completely die so a more ethical competitor can take its place it would be even better.
Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants
#7I feel bad for the people affected but at least the scummy company got what it deserved for stealing tips (for those unaware, they used to withhold the total tips out of a delivery drivers base compensation so essentially taking the tips for themselves). Now if they could just completely die so a more ethical competitor can take its place it would be even better.
[deleted]
Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants
#8I still worry about DoorDashes security - someone has signed up for services with my email account - not an issue, I just will never verify them. But they had signed up for DoorDash, and I didn't realize it, and then I tried to sign up for the first time via the Android App with that same email account. I selected the email account to my surprise it immediately let me into the other persons account! They had ostensibly set up a password, but I didn't need it and could see their phone number and bits of their payment information. I sent in a support email for that one, and got the account closed, but still, not a great sign.
Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants
#9I feel bad for the people affected but at least the scummy company got what it deserved for stealing tips (for those unaware, they used to withhold the total tips out of a delivery drivers base compensation so essentially taking the tips for themselves). Now if they could just completely die so a more ethical competitor can take its place it would be even better.
Yeah the Equifax breach was the nail in the coffin for them... Data breaches rarely hurt companies it seems.
Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants
#10I still worry about DoorDashes security - someone has signed up for services with my email account - not an issue, I just will never verify them. But they had signed up for DoorDash, and I didn't realize it, and then I tried to sign up for the first time via the Android App with that same email account. I selected the email account to my surprise it immediately let me into the other persons account! They had ostensib…
I don't understand, it just never prompted you for a password?