Doordash Was Breached for the Same Reason Everyone Is: Legacy MFA
By Kevin Surace | 4 minute read
Another Preventable Breach
Another week. Another preventable breach. This time it is Doordash, confirming that a social engineering scam gave attackers access to sensitive customer and driver information. But the real story is not the scam. The real story is the failure behind it.
The Real Failure: Legacy MFA
The weak link was legacy MFA. Again.
Doordash’s statement reads like every breach disclosure of the past two years. Attackers tricked an employee. Credentials were obtained. A login was approved. And suddenly the attacker had access to internal tools. The company emphasizes that no passwords were exposed. But that misses the point. The problem is that passwords no longer matter. Phishers do not need them. They only need a moment of human error and an MFA method that trusts the user too much.
Attackers Are Not Breaking In, They Are Logging In
This is why attackers keep winning. Legacy MFA still allows them to.
SMS codes. Authenticator apps. Push notifications. Time based OTP. These methods were not built for a world where AI can generate perfect phishing sites in 30 seconds and spoofed help desk calls are indistinguishable from the real thing. They cannot validate who is authenticating. They cannot validate where the request is coming from. And they cannot prevent a real-time relay attack when the victim truly believes they are logging into the legitimate site.
Modern Breaches Follow the Same Pattern
This is exactly how attackers keep getting in at Doordash, MGM, Caesars, Aflac, Qantas, Hawaiian Airlines, UnitedHealth, and hundreds more. They are not breaking in. They are logging in. With your unsuspecting employee’s MFA or authorization.
Training Will Never Solve This
The solution is not more training. The solution is not more warnings. The solution is not asking employees to stare longer at URLs. The solution is replacing the authentication system that keeps failing.
Where Token Changes Everything
This is where Token changes everything.
Token Ring and Token BioStick eliminate the entire attack path that brought down Doordash. They work differently than every legacy MFA method that attackers love.
They require a live biometric fingerprint match. No fingerprint means no login.
They require the device to be physically near the machine logging in. Remote attackers cannot authenticate from anywhere.
They cryptographically bind every credential to the real domain. A fake site cannot obtain a signature. The Token device simply refuses to respond.
They never send a push. They never generate a code. They never ask the user to approve anything. There is nothing to phish, nothing to relay, nothing to intercept.
What Would Have Happened if Doordash Used Token
If Doordash had deployed Token, the attacker’s entire playbook would have collapsed instantly. The phishing email would have been irrelevant. The spoofed request would have failed. No fingerprint means no signature. No proximity means no authentication. No domain match means no access.
This is the difference between legacy MFA and phishing resistant biometric FIDO2 authentication. One trusts the user and gets breached. The other trusts cryptography and stops the breach cold.
Every Enterprise Running Legacy MFA Faces the Same Risk
Doordash is not alone. Every enterprise still running legacy MFA is heading toward the same headline.
It does not matter how large the company is. It does not matter how trained the users are. Modern attackers only need a moment. Legacy MFA gives them everything else.
Replace the System That Fails
If you want to shut down real-time phishing, relay attacks, help desk exploitation, and social engineering completely, there is only one answer.
Use Token. Or wait for your version of the Doordash breach.
Get Token products online now at store.TokenRing.com
FAQs
Why did the Doordash breach happen even though passwords were not exposed?
Because passwords were not the problem. The attacker tricked an employee into approving a login with legacy MFA. These methods trust the user instead of verifying the fingerprint, proximity, or domain, which allows attackers to log in without ever knowing the password.
What makes legacy MFA so easy to bypass today?
SMS codes, authenticator apps, push notifications, and OTPs can all be phished or relayed in real time. AI tools make fake login pages and spoofed calls look real, so even trained employees get tricked. Once the user approves, the attacker is in.
How would Token have prevented the Doordash breach?
Token requires a live fingerprint, physical proximity, and a cryptographic domain check. Without those three conditions, no authentication is created. The attacker could not have approved anything, relayed anything, or logged in from anywhere. Token would have stopped the attack immediately.
Sign Up
Keep up to date with phishing and ransomware news.
Token will not sell, trade, lease, or rent your personal data to third parties.
