Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallYes—the DoorDash breach is real. DoorDash disclosed unauthorized access involving some consumers, Dashers and merchants. The company says affected information could include names, phone numbers, email addresses and physical or delivery addresses, but not payment-card, bank-account or government-identification data. DoorDash has not published how many people were affected.
What happened in DoorDash’s 2025 incident?
DoorDash says an employee was targeted in a social-engineering attack, leading to unauthorized access to information associated with some consumers, Dashers and merchants. The company says it shut down the access, investigated with help from an outside cybersecurity firm, strengthened employee training and security controls, and referred the matter to law enforcement. Its public notice does not identify the attacker, describe the complete technical path or name the employee. DoorDash’s consumer notice was posted November 13, 2025, and updated December 19, 2025.
The notice does not prominently state a precise date when the incident was detected. TechRadar reported October 25, 2025, as the detection date; treat that as a reported date, not a detailed forensic timeline confirmed in DoorDash’s notice. A related Dasher support notice describes a phishing attack targeted at a third-party vendor; the public information does not establish a more specific vendor breach narrative.
What information was exposed—and what was not?
DoorDash says the information varied by person. Its notice identifies basic contact and address information, while ruling out several financial and government-ID categories.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
| Category | What DoorDash says |
|---|---|
| Potentially accessed | First and last name, phone number, email address and physical address. Related support language refers to delivery address; the exact field and whether it was current may vary by person. |
| Not accessed in this incident | Social Security numbers, government identification, driver’s-license information, bank-account information and payment-card information. |
| Not specified in the public notice | A total number of affected people, a complete geographic breakdown, the attacker’s identity, and whether information was published or sold. |
DoorDash’s notice does not list passwords among the accessed information. That is not the same as an independently established guarantee that passwords were untouched. The company says it had no indication of fraud or identity theft involving the affected information at the time of its notice; that describes what it knew then, not a promise that later misuse is impossible. See DoorDash’s notice for its account of the data involved.
Who was affected, and can you tell if you were one of them?
DoorDash identifies consumers, Dashers and merchants as groups that may have been affected. It describes the group as some users or a small percentage in related support language, but does not publish a count. The fields exposed were not necessarily the same for everyone.
DoorDash says it notified affected users where required. Not receiving a notice does not prove that no information was involved, but it also does not mean you were affected. To check, use the app or navigate to DoorDash yourself rather than following a link in an unexpected email or text:
- Open the DoorDash app or manually enter DoorDash’s known website.
- Check the official support area and compare any notice with the information in DoorDash’s published incident notice.
- If support confirms your account was affected, ask which categories of information were involved. A notification or support response may not disclose every forensic detail.
- Do not call a number from an unsolicited message unless you can independently verify it through an official DoorDash channel.
The consumer notice is hosted on DoorDash’s Canadian help site, and the company also maintains a Spanish-language incident page. The Canadian page alone does not establish that only Canadian users were affected.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Why contact and address details still matter
“No payment information” is reassuring about one type of risk, but it does not make the exposed information harmless. A name, phone number, email and address together can help a scammer make an impersonation attempt feel genuine. A message about a fake refund, delivery problem or account closure may appear more credible if it uses a real name or address.
- Phishing and impersonation: A caller or message can pose as DoorDash support and use personal details to build trust.
- Account-takeover attempts: Contact information can support password-reset or social-engineering attempts. Reused passwords and sharing one-time login codes make those attempts more dangerous.
- Privacy and physical safety: An address is more sensitive than a generic email list, particularly for people whose work or circumstances make their location private. The notice does not establish that every address was a current home address.
- Fraud escalation: Contact details alone do not ordinarily let someone charge a payment card, but a convincing scam can try to trick a person into giving up card details, a password or a verification code.
These are plausible risks of exposed contact information, not evidence that DoorDash users were defrauded in this incident.
What to do now
1. Treat unexpected DoorDash messages cautiously
Do not follow unexpected links or attachments to resolve an order, refund or account warning. Go to DoorDash through the app instead. Never give someone who contacts you your full card number, bank-account details, password, security answers, identity documents or one-time login code. DoorDash specifically advises caution with unsolicited communications. Read its safety guidance.
2. Replace any reused password
The 2025 notice does not list passwords among the accessed data, but changing a reused DoorDash password is a sensible precaution. Set a long, unique password and change it anywhere else you used the same one. The older 2019 incident is different: DoorDash said hashed and salted passwords were among the information potentially accessed and recommended affected users reset them. DoorDash’s 2019 security notice describes that earlier event.
3. Protect the email account used for recovery
Use a unique password for your email account, turn on multi-factor authentication, and review recent sign-ins and recovery methods. Remove unfamiliar forwarding rules or connected apps. If someone can control your email, they may be able to pursue password resets on other services.
4. Add safeguards to your mobile account
Consider setting or confirming an account PIN with your mobile carrier and asking about SIM-swap or number-porting protections. This is a general precaution for exposed phone numbers; the DoorDash notice does not say that a SIM swap occurred.
5. Watch for targeted scam attempts
- Fake order-refund or delivery-problem messages
- Warnings that your DoorDash account will be deactivated
- Calls claiming to be DoorDash support
- Requests for a “verification” code
- Messages that mention a real address or order to establish credibility
Do not reply with sensitive information. Open the app or contact support through an independently verified DoorDash channel.
6. Do not assume a credit freeze is required
A credit freeze is generally most relevant when Social Security numbers or comparable identity data are exposed. DoorDash says those categories and financial information were not accessed in this incident, so the notice alone does not make a freeze or paid identity-monitoring subscription an automatic necessity. If you see suspicious activity, or your information was involved in another breach, consider standard consumer-protection options. The California Privacy Protection Agency’s breach-monitoring guidance explains monitoring steps.
Do not confuse the 2025 incident with DoorDash’s 2019 breach
DoorDash has disclosed more than one security incident. The 2019 breach involved a different group and different data categories; its scale and details should not be attributed to the 2025 event.
| 2025 incident | 2019 breach | |
|---|---|---|
| Who was in scope | Some consumers, Dashers and merchants; DoorDash did not publish a count. | A portion of users who joined on or before April 5, 2018. |
| Information described | Names, phone numbers, email addresses and physical or delivery addresses, varying by person. | Names, email and delivery addresses, order history, phone numbers and hashed, salted passwords. For some people, the last four digits of payment cards or bank accounts were accessed. |
| Additional data | DoorDash says payment, bank-account and government-ID data were not accessed. | About 100,000 Dashers’ driver’s-license numbers were reportedly accessed. DoorDash said full card numbers, CVVs and full bank-account information were not accessed. |
DoorDash’s 2019 notice and the California Attorney General appendix document the older incident. The 2019 user population and data exposure are not evidence of the 2025 incident’s size or scope.
What remains unclear about the 2025 breach?
DoorDash’s public notice does not give an affected-user total, identify the attacker, provide a complete technical account or say whether exposed information was published or sold. It also does not provide a full geographic breakdown. The company’s statement that it had no indication of fraud or identity theft applies to what it knew at the time of its notice; it does not establish that misuse can never occur.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
