The GrubHub data breach has compromised the personal information of an unspecified number of customers, merchants, and drivers.
The attack stemmed from a compromised account belonging to a third-party service provider supporting Grubhub.
“Our investigation found that the intrusion originated with an account belonging to a third-party service provider that provided support services to Grubhub,” the company announced on Monday.
Grubhub immediately terminated the service provider’s access and removed them from its systems.
Following the GrubHub data breach, the company engaged external forensic experts to assess the damage. They also rotated passwords and implemented enhanced anomaly detection across their internal services to prevent further unauthorized access.
The investigation revealed no evidence of access to sensitive financial data like full payment card numbers, bank account details, Social Security numbers, or driver’s license numbers. However, the GrubHub data breach did expose some information.
The attackers gained access to varying levels of data depending on the individual. This included names, email addresses, and phone numbers for some users. Some campus diners also had partial payment card information (card type and last four digits) compromised.
“The unauthorized individual accessed contact information of campus diners, as well as diners, merchants and drivers who interacted with our customer care service,” GrubHub stated.
Additionally, hashed passwords for certain legacy systems were accessed, prompting Grubhub to proactively rotate potentially at risk passwords.
Despite the GrubHub data breach not affecting Grubhub Marketplace account passwords, the company advises customers to use unique passwords for all accounts to mitigate risks. A Grubhub spokesperson was unavailable for immediate comment.
Grubhub operates as a food-ordering and delivery platform, boasting over 375,000 merchants and 200,000 delivery partners across more than 4,000 cities.
