DoorDash has confirmed a data breach.
The food delivery company said in a blog post Thursday that 4.9 million customers, delivery workers and merchants had their information stolen by hackers.
The breach happened at some point before May 4, 2019, the company said, but added that customers who joined after April 5, 2018 are not affected by the breach.
Users who joined the platform before April 5, 2018 had their name, email and delivery addresses, order history, phone numbers, and hashed and salted passwords stolen.
The company also said consumers had the last-four digits of their payment cards was also taken, though full numbers and card verification values (CVV) were not taken. Both delivery workers and merchants had the last four-digits of their bank account numbers stolen.
Around 100,000 delivery workers also had their driver’s license information stolen in the breach.
The news comes almost exactly a year after DoorDash customers complained that their accounts had been hacked. The company at the time denied a data breach and claimed attackers were running credential stuffing attacks, in which hackers take lists of stolen usernames and passwords and try them on other sites that may use the same credentials. But many of the customers we spoke to said their passwords were unique to DoorDash.
When asked, DoorDash could not explain how the affectedaccounts were breached.
A spokespersonf or DoorDash did not immediatley comment when reached.
