Removed: full bank account numbers. The stored field was the last four digits, a decision made years before the breach.
Outcome: millions of accounts affected, names and driving licence numbers taken, and nothing in the haul sufficient for fraudulent charges or withdrawals.
DoorDash’s 2019 breach affected millions of accounts, and its notification to the California Attorney General contains an unusually candid risk assessment: what was taken was “hashed, salted passwords—a form of rendering the actual password indecipherable to third parties, and the last four digits of your bank account number. Please note that full bank account information was not accessed. The information accessed is not sufficient to make fraudulent charges on your payment card or fraudulent withdrawals from your bank account.”
Names and driving licence numbers were in that haul, so this was a real breach with real consequences for the people notified. It was not a payments breach, because the truncation decision was made years earlier.
Source: DoorDash, notice to the California Attorney General (2019)