DoorDash 8-K reported as cyber incident disclosure, filing shows merger pact

What happened

A headline on SEC EDGAR dated 2026-10-29 says DoorDash, Inc. discloses a cyber incident in an SEC Form 8-K filing.

The document at that link does not describe a cyber incident. According to SEC EDGAR, it is Exhibit 2.1, an “Agreement and Plan of Merger” dated as of October 28, 2026, among DoorDash, Inc., Ibiza Merger Sub, Inc. and Maplebear Inc. d.b.a. Instacart.

The only security-related items in the provided text are entries in the agreement’s table of contents and index. These are a section titled “Data Privacy; Information Security; Cybersecurity” (Section 2.19) and a defined term “Security Incident” (Section 8.04), as shown on SEC EDGAR. The text of those sections is not included in the source, so their content is not confirmed.

The following details are not confirmed:

• whether any cyber incident occurred
• what systems or data might be involved
• any cause or timeline
• any attacker

DoorDash has not described an incident in the material provided, and the report has not been independently verified.

Am I affected?

Not confirmed. The source names no affected systems, customers, merchants, drivers or data types.

What to do now

1. Treat the “cyber incident” label as unverified until DoorDash or a primary filing describes an incident.
2. Check DoorDash’s SEC filings for an 8-K that contains incident details, and read the filing text itself rather than the listing headline.
3. Be cautious with unsolicited messages that reference a DoorDash or Instacart breach, since no breach is confirmed in the sources.

Sources

• SEC EDGAR: Exhibit 2.1, Agreement and Plan of Merger among DoorDash, Inc., Ibiza Merger Sub, Inc. and Maplebear Inc. d.b.a. Instacart