DoorDash Confirms Data Breach Affected 4.9 Million Customers, Workers, and Merchants (techcrunch.com) 29
An anonymous reader quotes a report from TechCrunch: DoorDash has confirmed a data breach. The food delivery company said in a blog post Thursday that 4.9 million customers, delivery workers and merchants had their information stolen by hackers. The breach happened on May 4, the company said, but added that customers who joined after April 5, 2018 are not affected by the breach. It's not clear why it took almost five months for DoorDash to detect the breach.
DoorDash spokesperson Mattie Magdovitz blamed the breach on "a third-party service provider," but the third-party was not named. "We immediately launched an investigation and outside security experts were engaged to assess what occurred," she said. Users who joined the platform before April 5, 2018 had their name, email and delivery addresses, order history, phone numbers, and hashed and salted passwords stolen. The company also said consumers had the last-four digits of their payment cards was also taken, though full numbers and card verification values (CVV) were not taken. Both delivery workers and merchants had the last four-digits of their bank account numbers stolen. Around 100,000 delivery workers also had their driver's license information stolen in the breach.
DoorDash spokesperson Mattie Magdovitz blamed the breach on "a third-party service provider," but the third-party was not named. "We immediately launched an investigation and outside security experts were engaged to assess what occurred," she said. Users who joined the platform before April 5, 2018 had their name, email and delivery addresses, order history, phone numbers, and hashed and salted passwords stolen. The company also said consumers had the last-four digits of their payment cards was also taken, though full numbers and card verification values (CVV) were not taken. Both delivery workers and merchants had the last four-digits of their bank account numbers stolen. Around 100,000 delivery workers also had their driver's license information stolen in the breach.
No excuse for this nonsense. (Score:2)
There are numerous ways to encrypt your data, I remember MIT did some CryptDB stuff with fully homomorphic encryption, wonder what ever happened to that. Microsoft also has "always encrypted" support, probably other DB vendors as well.
Re: (Score:3)
Encryption protects data at rest. When someone (or some system) is looking at the data, it need to be decrypted.
Encrypting your database protects you from someone stealing your hard drives or stealing your database files, but not from someone from attacking the application (XSS + SQL injection) or someone with access just outright taking it and fucking about with it.
Re: (Score:3)
wow someone gets it... no matter how you encrypt shit, at some point it has to be decrypted to be useful. At that same place, there in lies a vulnerability.
Re: (Score:3)
You can move that vulnerability around, and even narrow the window. You can make special cryptographic systems that allow useful operations to be performed on encrypted data, without having to decrypt the data. (homomorphic encryption and homomorphic secret sharing)
Standard practice today isn't necessarily the most secure way we know of, nor is it the pinnacle of technology. New capabilities are being thought of all the time, and eventually some of those new systems will find practical application.
Re: (Score:3)
Re: (Score:3)
There are numerous ways for insiders to steal that information and sell it to criminals and make it look like outsiders. It happens so often that insiders are far more likely to be involved, I mean underpaid and download some data and instant bonus or drugs. Disposable workers = disposable companies = equals disposable customers. Beware handing over you details to the cheapest offshore labour they can find, those details will be in the criminal market before you know and in this case for over 6 months.
Not even surprising (Score:3, Insightful)
Data breaches have become as common as white men going on mass shooting sprees. It's not even newsworthy any more.
Not completely stupid (Score:5, Interesting)
Hey, they weren't completely stupid. They supposedly hashed and salted the passwords, and only kept partial credit card information.
Perhaps the corps are learning. Crank up the penalties a little higher until they achieve some kind of reasonable standard.
Re: (Score:2)
Hey, they weren't completely stupid. They supposedly hashed and salted the passwords, and only kept partial credit card information.
Perhaps the corps are learning. Crank up the penalties a little higher until they achieve some kind of reasonable standard.
"Around 100,000 delivery workers also had their driver's license information stolen in the breach."
They were stupid enough
Re: Not completely stupid (Score:3, Insightful)
Re: (Score:2, Informative)
What penalties? Right now, in the US, there are zero criminal or civil penalties to a data breach.
Re: (Score:3)
I guess you guys have extra cranking to do then.
Re: (Score:3, Interesting)
Well, a quick and probably insufficient analogy.
Someone breaks the lock on my front door, or breaks a window.
Gets in the house and steals my Aunt Elma's phone number from my list of emergency contacts.
The alarm went off , the police showed up.
The guy was already gone, and he had stolen Aunt Elma's personal data.
Have i committed a crime?
Re: (Score:1)
Re: (Score:3)
Even the US has such laws. It's called HIPPA. Yes, it's special purpose. Other countries have more comprehensive laws.
Re: (Score:2)
Re: (Score:2)
Yes.
Re:Not completely stupid (Score:4, Insightful)
As with all analogies, yours is a bit off.
Try this one:
You put money in the bank. The bank assures you that it's completely reliable, and will definitely protect your money. It's safe. Trust us. The bank doesn't bother with a vault, security system, or really any standard protections, but just leaves all the cash in clearly marked bags in full view of the plate glass window. It gets stolen. Has the bank committed a crime? Quite likely. It's called negligence most places.
And even with the bank, you're choosing to give them your money. With many of these companies you don't have a choice whether they retain your information or not.
Re: (Score:2)
"With many of these companies you don't have a choice whether they retain your information or not."
You always have the choice to give them your information. If you do not want them to have it, then simply do not let them have it. Nothing hard about that at all.
Re: (Score:2)
Yeah , but my analogy helped support my argument better. Your analogy helps support yours.
I think the answer may lie somewhere in the middle.
Like where most companies are today. They try to protect the data, for the most part.
If a company tries to protect your data and it is stolen I don't think it should be a crime.
If a company has knowledge of a vulnerability and does nothing, that should be considered criminal negligence.
Re: (Score:2)
That's usually how the laws work, and not just data protection. It's not illegal to crash into someone else's car. It's illegal to do it on purpose, while drunk, without insurance, or while not following the rules of the road.
If you're collecting and storing people's valuable information then you have a responsibility to protect it using standard procedures.
Re: (Score:1)
Hey, they weren't completely stupid. They supposedly hashed and salted the passwords, and only kept partial credit card information.
Perhaps the corps are learning. Crank up the penalties a little higher until they achieve some kind of reasonable standard.
Perhaps a little pepper is in order
shut up (Score:1)
So... if the fact that they steal your food... (Score:3, Interesting)
So if the fact that 2/3rds of food delivery people admit to regularly stealing bits of their customer foods and even using the spoons, etc, isn't enough to put you off using them, you have to figure in that it's yet another place to have your data stolen from.
Is it really that much of a convenience when they're spreading germs and making you have to follow up with loss prevention after your data gets stolen. Sometimes laziness is a very costly thing.
Mozilla: Consumer Protection Oversight (Score:2)
Re: (Score:2)
Uh no. The Mozilla foundation is part of the problem. Firefox was changed so that local archiver Scrapbook+ would no longer work, and Mozilla spent TWENTY MILLION DOLLARS of DONATION MONEY to buy Pocket which stores pages on someone else's server who then knows what you're saving. Not only did they waste donations buying spyware, they then integrated it into the browser instead of making it an add-on.
The Mozilla foundation is an event of privacy. Not to the same extent as Google, but in a very real way.
Re: (Score:2)
Make that "enemy of privacy".
Fucking A, this site is the exact opposite of a triumph of design.
And I can't change my password (Score:2)
Maybe it just doesn't take immediate effect, but I've tried twice now and it's been over 15 minutes. I didn't get any error messages, but when I logged out and back in I still had to use the old one.
At least 2FA was turned on by default. It's the thought that counts, right?
I reviewed my order history just to make sure. It looks right. I didn't even realize I could rate my orders and I thought it funny that I could rate the order that I placed for pickup. Yeah, that delivery was excellent! Since then I