Grubhub says hack on third-party exposed information on campus customers

Grubhub disclosed a security incident originating from a third-party support vendor that exposed customer contact information, card types and the last four digits of payment cards, and hashed passwords for some legacy systems; the company says it terminated the vendor's access, rotated potentially leaked credentials, and believes the incident is contained, but did not provide details on scope, timing, or the attacker.