Grubhub says user, driver data compromised in security breach

In a Monday press release, Grubhub said, “We recently identified a security incident involving a third-party contractor, resulting in unauthorized access to certain user contact information. We took immediate action to contain the situation and have worked with leading forensic experts to investigate the matter. We are confident that the incident has been fully contained. We recently detected unusual activity within our environment traced to a third-party service provider for our Support Team. Upon discovery, we promptly launched an investigation, identifying unauthorized access to an account associated with this provider. We immediately terminated the account’s access and removed the service provider from our systems altogether. The unauthorized individual accessed contact information of campus diners, as well as diners, merchants and drivers who interacted with our customer care service. The following data was accessed, varying by individual: Names, email addresses and phone numbers; Partial payment card information for a subset of campus diners. The unauthorized party also accessed hashed passwords for certain legacy systems, and we proactively rotated any passwords that we believed might have been at risk. While the threat actor did not access any passwords associated with Grubhub Marketplace accounts, as always, we encourage customers to use unique passwords to minimize risk.”