Food delivery firm GrubHub on Monday disclosed a data breach that resulted in customer and driver information getting compromised.
According to GrubHub, the incident was discovered recently, when the company saw unusual activity within its environment. An investigation showed that someone had compromised an account associated with a third-party provider of support services.
The unauthorized access was quickly terminated, and the hacked account and the third-party vendor using it were removed.
However, the probe showed that the attacker did manage to gain access to contact information belonging to diners, merchants and drivers who interacted with GrubHub’s customer care service.
The hackers may have stolen names, email addresses, and phone numbers, along with partial payment card information for some campus diners (last four digits of the card’s number and the card’s type).
The compromised information also includes hashed passwords for some legacy systems. Those passwords have been reset in response to the incident.
The food delivery giant noted that GrubHub marketplace customer passwords, merchant login information, Social Security numbers, bank account information, and full credit card numbers were not affected.
The company has taken action to further improve its security against such threats, including the deployment of additional anomaly detection systems for internal services.
SecurityWeek has reached out to GrubHub to find out how many individuals are impacted by the incident and whether the attack was conducted by a ransomware group. No known ransomware gang has taken credit for the attack at the time of writing.
Related: Hundreds of Thousands Hit by Data Breaches at Healthcare Firms in Colorado, North Carolina
Related: Insurance Company Globe Life Notifying 850,000 People of Data Breach
Related: 1 Million Impacted by Data Breach at Connecticut Healthcare Provider
Related: NorthBay Health Data Breach Impacts 569,000 Individuals
