GrubHub data breach impacts customers, drivers, and merchants

GrubHub disclosed an intrusion originating from a third‑party service provider account that exposed contact information (names, emails, phone numbers), partial payment card details (card type and last four digits for some users) and hashed passwords from legacy systems; the company terminated the vendor’s access, rotated credentials, and retained external forensic investigators while reporting no evidence that full payment card numbers, bank account data, Social Security numbers, or driver’s license numbers were accessed.