DoorDash’s Data Breach Is the Latest in Cyber Security Issues for Foodservice Brands

Although the world of third-party delivery may be thriving, it isn’t all coming up roses. This past Thursday, third-party delivery company DoorDash confirmed that it suffered a data breach on May 4 that affected 4.9 million users. According to TechCrunch, users had their name, email and delivery addresses, order history, phone numbers and passwords stolen.

“The diverse assortment of data that has been stolen could easily allow hackers to engage in identity theft and might result in DoorDash customers being targeted by spear-phishing campaigns designed to prise more data from them,” Ray Walsh, digital privacy advocate at ProPrivacy said in an email. “DoorDash has admitted that the last four digits of some customers' card details have been exposed, meaning that hackers could attempt to trick users into providing the rest of their details using sophisticated phishing attempts.”

In the past, the foodservice space has proven to be vulnerable to hackers, especially as more and more QSR and fast casual restaurants become dependent on third-party services—like delivery aggregates—as these apps create an additional entry point for hackers to access customer data. 

Earlier this year, Wendy’s agreed to a $50 million settlement related to a class-action lawsuit brought against the company following cyberattacks that targeted POS systems at more than 1,000 Wendy's locations in 2015 and 2016. In 2017, a breach at Sonic led to 5 million payment card accounts to appear on the dark web as part of a fire sale.

While this type of third-party breach may turn some franchisors off of DoorDash, the risk is a much larger issue. In fact, another online and mobile food ordering service, EatStreet, reported a security breach around the same time period as the DoorDash breach. According to Tech Republic, there have been more than 3,800 breaches thus far in 2019, over a 50% uptick over the past four years. 

Franchisees often depend on the franchisor for security and feel like that is enough to protect the business. As the cyber attack trend becomes more common, franchisors will need to train franchisees to be more proactive and strategic with their security measures—especially in regards to third-party applications—to make sure no employees unsuspectingly open a phishing email or click the wrong link.