An "unauthorized third party" gained access to DoorDash users' information after an employee was targeted in a scam.