DoorDash Discloses Data Breach And Agrees To $18 Million Settlement With Chicago
DoorDash is facing renewed scrutiny on two fronts after revealing a cybersecurity incident affecting users and agreeing to an $18 million settlement with the City of Chicago over allegations of deceptive business practices dating back to the pandemic.
The twin developments, announced within days of each other, land at a time of increased volatility for the food delivery giant, whose share price has recently come under pressure.
Employee Targeted In Social Engineering Attack
In a notice sent to users on 13 November, DoorDash confirmed it had suffered a data breach following a social engineering attack on an employee.
The incident, which occurred on 25 October, allowed an unauthorised individual to access personal details for a subset of users, including delivery drivers (Dashers) and merchants. Exposed information included names, email addresses, phone numbers and physical addresses.
DoorDash said it revoked the attacker’s access as soon as the intrusion was detected, informed affected users and notified law enforcement, which is now investigating.
The company stressed that financial and highly sensitive information was not compromised. According to DoorDash, payment card data, government identification numbers and Social Security numbers were not accessed, and there is currently no evidence that the exposed data has been used for fraud or identity theft.
That reassurance has not muted criticism online. Commenters on Reddit and other platforms have pushed back at the suggestion that names and home addresses are relatively low risk, warning that such information can still be misused for harassment, stalking or targeted scams.
DoorDash said it is responding by reinforcing staff training and tightening authentication processes in an effort to reduce the likelihood of similar attacks in future.
The breach comes against a choppy market backdrop. While DoorDash shares are up about 23.8 percent so far this year, the stock has fallen 21 percent in the past month and 16 percent over the most recent quarter, reflecting investor unease following the company’s third quarter results.
$18 Million Deal Ends Chicago Lawsuit Over Fees And Tips
A day after disclosing the breach, DoorDash moved to close the book on a separate legal fight.
On 14 November, the company agreed to pay $18 million to settle a 2021 lawsuit brought by the City of Chicago. The case accused DoorDash of hiding fees from customers, using tips to offset its own costs and listing restaurants on the platform without their permission during the height of the Covid-19 pandemic.
Chicago alleged that diners were not clearly told about service and delivery charges, that drivers’ tips were used to subsidise base pay rather than being passed through in full, and that some restaurants appeared on the app without having consented to be there.
DoorDash said the settlement does not constitute an admission of wrongdoing and argued that the practices highlighted in the lawsuit are no longer part of its business model.
Under the agreement, the $18 million payout will be divided as follows:
-
$4 million in credits for eligible Chicago customers, scheduled to begin on 28 January 2026.
-
$3.25 million for restaurants that were previously listed on DoorDash without their consent and are not currently using the platform.
-
$5.8 million in delivery commission relief and marketing credits for eligible restaurants.
-
$500,000 for Dashers who were delivering food orders in Chicago as of September 2019.
-
$4.5 million to the City of Chicago to cover the costs of the investigation and lawsuit.
The case was part of a broader city probe into the business practices of third party delivery services. A similar lawsuit against rival Grubhub, filed as part of the same investigation, is still ongoing.
Mounting Pressure On Delivery Platforms
Together, the breach and the settlement underscore the regulatory, legal and security pressures facing large food delivery platforms as they mature from high growth startups into entrenched consumer services.
DoorDash now has to reassure customers, drivers, restaurants, investors and regulators that it can protect personal data, operate transparently and respond quickly when issues arise.
For now, the company is framing the data incident as contained and the Chicago settlement as a way to move past historic disputes. Whether those steps are enough to steady investor confidence and public trust will become clearer over the coming months as regulators, customers and markets react.
Photo Credit: DepositPhotos.com