Hacker News Reader

The official blog post doesn't give any information about the breach except "We noticed a third-party had unauthorized access to DoorDash data", and the TechCrunch article says that DoorDash responded that they couldn't explain how the breach happened. How are they so sure that they fixed the underlying cause if they don't even know how the third-party got access in the first place?

View on HN

"couldn't explain" = Were too embarrassed to explain... or could expose themselves to several lawsuits by revealing.

It seems like the breach was through a third party that only had old data, since nobody that registered after April 5, 2018 is affected.

So it's probably some service that they no longer use and doesn't really need to be fixed or investigated, since all the data they had has already been taken and they (probably) stopped giving them more data a year and a half ago.

They should really say who the third party was though. Hopefully that information comes out.

A year ago customers were complaning that their accounts were accounted despite using an unique password to DoorDash. DoorDash at that time denied any hacking incidents.

A more sinister explanation is that DoorDash knew back then who is leaking their data and removed their access. But chose to disclose only just now.

Reply on news.ycombinator.com