doordash.com Domain Breach Exposure Report

The telemetry indicates a significant exposure impacting DoorDash, with over 591,000 client events and nearly 7,000 employee events observed within the reporting period. The data is heavily skewed towards historical data breaches (83.8%) and active infostealer logs (16.2%), totaling nearly 600,000 events. Key infostealer families like Rhadamanthys, LummaC2, and Redline are prominent, suggesting credential harvesting and potential account takeovers. The exposure is geographically concentrated in the United States, Canada, and Australia. The primary targeted services are related to DoorDash's identity and authentication infrastructure, indicating a focus on user credentials. Given the high volume of data breach and infostealer events, coupled with the targeting of authentication services, this situation presents a critical risk. The prevalence of infostealers suggests that user credentials may have been compromised, potentially leading to unauthorized access and further downstream impacts. Remediation efforts should focus on enhancing authentication mechanisms, monitoring for credential stuffing attacks, and investigating the source and scope of the data breaches and infostealer activity.