Loading story…
DoorDash, a major food delivery service, suffered a data breach on October 25, 2025, after an employee was deceived by a social engineering scam. The attacker gained unauthorized access to internal systems, resulting in the exposure of user contact information, including full names, physical addresses, email addresses, and phone numbers. The breach affected customers, delivery drivers, and merchants across the United States, Canada, Australia, and New Zealand. DoorDash's security team detected the incident and responded by shutting down the unauthorized access and launching an investigation, while also notifying law enforcement.
DoorDash has stated that no sensitive financial or government identification data, such as credit card numbers or Social Security numbers, was compromised. However, the combination of names, emails, and phone numbers raises concerns about the potential for targeted phishing or smishing attacks. The company has begun notifying affected users, with reports indicating that Canadian users were among the first to receive alerts. This incident marks the third significant security breach for DoorDash in recent years, following previous incidents in 2019 and 2022.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
By mid-November 2025, DoorDash confirmed the data breach and disclosed that user information had been exposed as a result of the October incident. News coverage on November 13-18 reported the company’s acknowledgment and details of the compromised data.
During the October 2025 incident, attackers accessed DoorDash user information, including names, phone numbers, and physical addresses, with some reports saying millions of users may have been affected. The breach exposed customer data but the exact scope was not consistently reported across sources.
In October 2025, attackers used a social engineering scam against a DoorDash employee to gain unauthorized access to company data. Multiple reports describe the breach as stemming from employee compromise rather than a software exploit.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcetechcrunch.com
Open sourcetechrepublic.com
Open sourcescworld.com
Open sourcehackread.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Grubhub confirmed that unauthorized actors downloaded data from some of its internal systems and that the company is now facing extortion demands. Grubhub said it investigated and stopped the activity and stated that *sensitive information* such as financial data and order history was not impacted; it also engaged a third-party cybersecurity firm and notified law enforcement. Sources cited in reporting attribute the extortion attempt to **ShinyHunters**, with the threat actors allegedly demanding Bitcoin to prevent publication of data. According to sources, the extortion leverages both older **Salesforce** data tied to a February 2025 incident and newer data allegedly taken from **Zendesk**, which Grubhub uses for customer support chat. Reporting also links the intrusion to follow-on activity stemming from the broader **Salesloft Drift**-related credential/OAuth token theft activity, where compromised tokens for Salesloft’s Salesforce integration were used to harvest credentials and secrets for subsequent attacks against downstream services. Separately, Monroe University disclosed a distinct 2024 network breach affecting ~320,000 individuals; it is unrelated to the Grubhub incident and involves theft of extensive personal, financial, and health data.
Jun 29, 2026
Turkish restaurant chain **Baydöner** suffered a data breach that exposed customer information and was later advertised on a public hacking forum. Reporting on the incident said the breach affected up to **3.7 million customer records**, while breach-tracking data identified more than **1.2 million unique email addresses** in the exposed dataset. The compromised information included names, email addresses, phone numbers, cities of residence, and **plaintext passwords**. A smaller subset of records also contained Turkish national ID numbers and dates of birth. Baydöner said in its disclosure notice that **payment and financial data were not impacted** by the incident.
Jun 29, 2026
Online grocery delivery service **Weee!** confirmed a data breach affecting about **1.1 million customers**, after reports surfaced that a large dataset tied to the company had been leaked online. Exposed information reportedly included names, email addresses, phone numbers, home addresses, and account-related details such as delivery preferences, device information, dates, and customer notes left for couriers; some of those notes allegedly contained sensitive building entry instructions. Reporting linked the leaked dataset to a threat actor associated with other high-profile data exposures, including a prior US Cellular-related leak. The compromised records raise risks of phishing, scams, identity fraud, and physical security concerns because the data could help attackers profile victims or misuse address and access details. Weee! acknowledged the incident as scrutiny grew over how consumer delivery platforms store large volumes of personal information and expand exposure through third-party services.
Jun 29, 2026