Food delivery service Grubhub has suffered a security breach that exposed sensitive information belonging to customers, drivers, and merchants. The breach, caused by unauthorized access through a third-party service provider, compromised personal details, hashed passwords, and partial credit card information.
Grubhub detected suspicious activity within its system, which was later traced to an account used by a third-party customer support provider. The company quickly revoked access to this account and removed the provider from its platform to prevent further unauthorized entry.
What Information Was Compromised?
Hackers gained access to various user data, including:
1. Full names, email addresses, and phone numbers
2. Hashed passwords (which are encrypted for security)
3. Partial credit card details (only the card type and last four digits)
The breach affected individuals who had previously interacted with Grubhub’s customer support or used its campus dining services. However, full payment card details and bank account information were not accessed.
Steps Taken by Grubhub
In response to the breach, Grubhub has implemented several security measures:
- Resetting passwords for affected accounts
- Blocking access to the compromised third-party account
- Enhancing security protocols to prevent similar incidents in the future
Although the exact number of affected users and the timeline of the breach have not been disclosed, Grubhub is working to strengthen its security systems.
This breach comes as Grubhub prepares for a major business transition. Its parent company, Just Eat, is finalizing a $650 million sale of Grubhub to food hall startup Wonder. The deal, announced in November 2024, is expected to be completed by early 2025.
How Users Can Stay Safe
If you have a Grubhub account, consider taking the following precautions:
1. Update your password immediately, especially if you use the same password on other platforms.
2. Turn on two-factor authentication (2FA) for extra security.
3. Be cautious of phishing emails pretending to be from Grubhub.
4. Monitor your credit card and bank statements for unusual activity.
This incident underscores the risks associated with third-party service providers in handling user data. As cyber threats continue to rise, companies must implement stronger security measures to protect customer information and prevent future breaches.