In the recent news, DoorDash has announced that personal customer data comprising phone numbers, emails, and delivery addresses were compromised by hackers who infiltrated the computer system of a vendor. Hackers gained access to some of DoorDash’s internal tools by using a phishing attack on a third-party vendor that exposed employee credentials, the company said Thursday in a blog post. DoorDash said the vendor’s access to its systems was “swiftly disabled.”
Small Percentage of Personal Customer Data Was Compromised
DoorDash says that a “small percentage” of users were affected by the incident but declined to say how many users it currently has or provide an accurate number of affected users. The company said it cut off the third-party vendor’s access to its systems after discovering “unusual and suspicious” activity. DoorDash did not name the third-party vendor, which “provides services that require limited access to some internal tools,” according to DoorDash spokesperson Justin Crowley, but confirmed that the vendor breach is linked to the phishing campaign that compromised SMS and messaging giant Twilio on August 4.
Researchers Have Linked This Cyber Attack to a Wider Phishing Campaign
Researchers linked these attacks to a wider phishing campaign by the same hacking group, dubbed “0ktapus,” which has stolen close to 10,000 employee credentials from at least 130 organizations, including Twilio, Signal, internet companies, and outsourced customer service providers, since March. DoorDash says that since discovering the compromise the company hired an unnamed cybersecurity expert to help with its ongoing investigation and is taking action to “further enhance DoorDash’s already robust security systems.”
Read more: Free Chinese VPN Found Guilty of Exposing Billions of Users’ Data
