Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DoorDash confirms data breach affected 4.9M customers, workers and merchants

techcrunch.com

Post reply on HN
Print view View original

41–50 of 224 posts

Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants

#41

Post by bdcravens »

Nextgrid wrote: post #34
SomaticPirate wrote: post #9

Earlier quoted context omitted.

Yeah the Equifax breach was the nail in the coffin for them... Data breaches rarely hurt companies it seems.

Equifax's story is different, people don't have a choice whether to use them (if people did they'd already be out of business) and they have a near-monopoly, not to mention they are profitable so they are here to stay. Doordash? They're just a shitty startup trying to "disrupt" the market by forgetting laws and morals and are only surviving thanks to VC money. People are not obliged to use them, and since they're ess…

> Doordash's inevitable demise

Perhaps it's different elsewhere, but out of the services I use here in Houston, Doordash is consistently the best experience. Obviously if one of those competitors can best them in categories that matter (cost, speed, and accuracy) I'll switch.

Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants

#42

Post by jacquesm »

There is a silver lining in all these data breaches. At some point in time all our data will have been leaked at least once and probably more than once and subsequent leaks will not do any more damage.

The safe assumption would then be to not trust any accounts created online without some good old KYC processes in place requiring live verification of identity.

Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants

#43

Post by Nextgrid »

RHSeeger wrote: post #36
Nextgrid wrote: post #6

I feel bad for the people affected but at least the scummy company got what it deserved for stealing tips (for those unaware, they used to withhold the total tips out of a delivery drivers base compensation so essentially taking the tips for themselves). Now if they could just completely die so a more ethical competitor can take its place it would be even better.

They did no such thing, and I find it frustrating that people keep repeating this falsehood. Doordash promised to pay drives at least $X (where X was, I believe $1 or something like that) AND that the driver will make at least $Y from the delivery. The driver always gets the tip, plus a variable amount from DD. This is _exactly_ how it works for wait staff in restaurants in most states, except that is by hour instead…

Did they make that clear to the end customer that this is what's happening with the tips? I don't care what their contract with the delivery driver states, if they allow me to add a tip I expect that tip to go in the driver's pocket in addition to whatever they'd get paid without the tip, just like if I was giving them cash directly. If that's not what's happening they have essentially defrauded me and I wouldn't be too happy about that.

Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants

#44

Post by adtac »

>The breach happened on May 4

I don't believe for one second that they didn't know about it for five months! Can someone in the EU please report this so that it's investigated for a GDPR violation?

Edit: from the official post on blog.doordash.com:

>Earlier this month, we became aware of unusual activity involving a third-party service provider.

Of course. This is quite a bit more than the 72 hour window GDPR allows.

Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants

#45

Post by Nextgrid »

hollerith wrote: post #40
Nextgrid wrote: post #34

Earlier quoted context omitted.

Equifax's story is different, people don't have a choice whether to use them (if people did they'd already be out of business) and they have a near-monopoly, not to mention they are profitable so they are here to stay. Doordash? They're just a shitty startup trying to "disrupt" the market by forgetting laws and morals and are only surviving thanks to VC money. People are not obliged to use them, and since they're ess…

What product or service do you believe that Equifax is near being a monopoly provider for?

Credit reference agency? Okay there are 3 of those, but given that pretty much every single financial institution both queries and reports to all 3 they all have a monopoly and neither is going away.

Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants

#46

Post by njarboe »

hombre_fatal wrote: post #28
cj wrote: post #13

> The information accessed is not sufficient to make fraudulent charges on your payment card. In other words... "We leaked a bunch of your personal information, but at least it's not enough data to steal your money!" All of these leaks have the cumulative effect of making ineffective very commonly used security verification questions: "Can I verify that last 4 of your social? And the last 4 of your credit card?" How…

Hell, imagine how many scans of people’s passports and driver’s licenses are sitting in databases waiting to be leaked, yet images of those documents let you authenticate with all sorts of financial institutions online from banks to Coinbase to Paypal. We really need to rethink all this. Until then, it feels like mere luck that today wasn’t the day someone decided to social engineer their way into your life. Everythi…

If militaries have any imagination, they already have this data for their adversaries' populations and have cyber weapons ready to do this quickly at massive scale.

Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants

#47

Post by Nextgrid »

bdcravens wrote: post #41
Nextgrid wrote: post #34

Earlier quoted context omitted.

Equifax's story is different, people don't have a choice whether to use them (if people did they'd already be out of business) and they have a near-monopoly, not to mention they are profitable so they are here to stay. Doordash? They're just a shitty startup trying to "disrupt" the market by forgetting laws and morals and are only surviving thanks to VC money. People are not obliged to use them, and since they're ess…

> Doordash's inevitable demise Perhaps it's different elsewhere, but out of the services I use here in Houston, Doordash is consistently the best experience. Obviously if one of those competitors can best them in categories that matter (cost, speed, and accuracy) I'll switch.

> Obviously if one of those competitors can best them in categories that matter (cost, speed, and accuracy) I'll switch.

It's just a matter of time anyway, the VC money will dry up, they will either go down the drain right away or raise prices, which if nothing else will open the doors for another VC-fuelled competitor to overtake the market by subsidising deliveries for the next few years.

Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants

#48

Post by Nas808 »

standardUser wrote: post #16

At this point HN should just have a permanent module in the top right corner announcing the latest data breach.

It's far too common now and there doesn't seem to be any meaningful consequences for the websites/companies involved.

Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants

#49

Post by jacquesm »

Operyl wrote: post #24
dvtrn wrote: post #21

Earlier quoted context omitted.

"Days since last publicly disclosed data breach breach: 0"

Honestly? A minutes scale might be more appropriate there. Unless we add the "Major" but then, what is major?

The UK ICO has an upper limit of 10 accounts leaked, above that they consider it to be a major breach.

I can't find a reference but when I first learned about this I was actually surprised the number was that low. That was before I realized that working with computers and databases for so long has totally desensitized me to the fact that we are dealing with stupendous amounts of data on a daily basis and that what we IT people see as 'small' is likely not what entities such as the ICO or other DPAs see as small.

Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants

#50

Post by njarboe »

hombre_fatal wrote: post #39
boobePhuu7iet7i wrote: post #26

Earlier quoted context omitted.

But now they have a dump of how many peoples names, address and phone numbers?

Leaking is only part of the problem. The main issue is that this information lets you authenticate with anything at all or as a starting point for social engineering. For example, you could build your own database of millions of records of name/phone/addr just looking up WHOIS info on every domain name you come across. And I'm reminded of how you can get into someone's Amazon account by feeding WHOIS information to t…

Cash really is underrated.
Post reply on HN