Grubhub serves up security incident with a side of needing to change your password

Grubhub disclosed a security incident involving a third-party contractor that resulted in unauthorized access to certain user contact information and some semi-sensitive data (e.g., partial card info) for customers, merchants, and drivers; the company says no full credentials or highly sensitive records (SSNs, driver’s licenses, bank account details) were exposed, that it revoked the vendor's access, rotated hashed internal passwords, engaged forensic experts, and deployed stronger credential and anomaly-detection controls.