DoorDash Third-Party Service Provider Breach (2019)

DoorDash is a US-based food delivery marketplace connecting customers, merchants and delivery workers.

4 May 2019. Suspicious activity detected on DoorDash systems attributed to a third-party service provider.

26 Sep 2019. DoorDash publicly disclosed the incident.

Impact. 4.9 million users, merchants and Dashers affected; consumers, restaurants and drivers each with different data types exposed.

• An unauthorised third party accessed DoorDash data via a service provider.
• Consumer data included names, emails, phone numbers, hashed passwords and last four digits of payment cards.
• Some delivery workers had driver license numbers exposed.
• Some merchants had last four digits of bank account numbers exposed.

• Service provider had marketplace-wide scope. One vendor could touch every constituent.
• Different data classes concentrated in one vendor. Consumer, merchant and driver data co-located.
• Detection lag was months long. Discovery-to-disclosure ran into weeks.
• Contractual controls did not extend to data segmentation. All parties shared one vendor scope.

• 4.9 million affected across all sides of the marketplace.
• Multi-state notification and litigation.
• Reputational damage during a competitive marketplace period.

The incident pushed marketplace platforms to segment vendor access by constituent and to shorten breach-notification windows.

One breach, three victim classes. Consumers, merchants and drivers each felt different consequences from the same vendor incident.

1. Segment vendor access by marketplace side.
2. Minimise data types held per vendor.
3. Require hours-based breach notification.
4. Continuously monitor service provider activity.
5. Rehearse notification for multi-constituent breaches.
6. Include marketplace vendors in tier-1 reviews.
7. Track vendor incident MTTR.
8. Report marketplace vendor risk to the board.

"When one vendor sees every side of your marketplace, one breach hits every side."