DoorDash data breach affects personal info of 4.9 million customers, merchants

Online food delivery service DoorDash says it's the victim of a data breach in which the personal information of 4.9 million people was stolen, including names, email addresses, delivery addresses, phone numbers, and partial banking and credit card details.

DoorDash, which allows people to order food from a website or smartphone to be deliveredto them, said Thursday an "unauthorized third party" accessed some of the San Francisco-based company'suser data on May 4.

As a result, information oncustomers, merchants and even some delivery drivers was stolen, including partial but not complete banking and credit card data, and driver'slicence numbers for 100,000 delivery people.

The company saidit has closed the access point the cybercriminalsused, but the result is anyone who joined the service before April 5, 2018, is possibly impacted. Anyone who joined after that date is not.

Change passwords, DoorDash urges

DoorDash says it is in the process of contacting everyone affected, but as a precaution, it is encouraging all customers to change their passwords via a dedicated website.

The company operates in 4,000 cities, including 92markets scattered across every Canadian province, so some Canadians are impacted.

But the company won't say how many, exactly.

"The overall proportion of users affected represents a small percentage of our community," spokespersonMattie Magdovitztold CBC News.

"We remain wholly focused on our investigation and on doing the right thing for the DoorDash community, particularly those affected."