GrubHub Hit by Data BreachGrubHub Hit by Data Breach

Food delivery company GrubHub has been hit by a data breach the company said jeopardized user contact information. 

The company announced this week that the security incident involved a third-party contractor that resulted in unauthorized access. GrubHub said it believed the breach originated with an account that belonged to a third-party support services provider. 

GrubHub said it took immediate action to contain the situation, and the company is working with leading forensic experts to investigate, saying they are confident the incident has been fully contained. 

“We recently detected unusual activity within our environment traced to a third-party service provider for our support team,” GrubHub said in a website statement. “Upon discovery, we promptly launched an investigation, identifying unauthorized access to an account associated with this provider. We immediately terminated the account’s access and removed the service provider from our systems altogether.”

The data accessed included the contact information of campus diners along with diners, merchants and drivers who interacted with the Grub Hub customer care service. GrubHub said the accessed data varied by individual but included names, email addresses, phone numbers and partial payment card information including card type and the last four digits of the card number. 

Related:GrubHub, AVRide to Bring Robot Deliveries to More Colleges

“The authorized party also accessed hashed passwords for certain legacy systems, and we proactively rotated any passwords that we believed might have been at risk,” GrubHub said. “While the threat actor did not access any passwords associated with Grubhub Marketplace accounts, as always, we encourage customers to use unique passwords to minimize risk.”

GrubHub said it has taken steps to further secure its systems including partnering with a cybersecurity firm to conduct a comprehensive investigation, strengthened its credential security and enhanced monitoring across its internal services.