Delivery company Grubhub on Monday said a hacker broke into its customer support system and gained access to some restaurant, customer and driver information.
The hacker got in through the account of a third-party vendor that Grubhub used for its support services. Grubhub said it quickly took action and that the situation is now fully contained.
However, some user data was exposed in the attack. That includes the names, email addresses and phone numbers of customers, businesses and drivers who interacted with Grubhub’s customer care service. Partial payment card information for a subset of student diners was also exposed—specifically the card type and the last four digits of the card number.
The hacker did not access customer or restaurant logins for Grubhub’s ordering marketplace. Other highly sensitive information, such as full payment card numbers, bank account details or Social Security numbers, was also secure.
Grubhub said it has stopped working with the vendor in question. It also hired a cybersecurity firm to do a full investigation, changed internal passwords and installed additional anomaly detection software.
The Chicago-based company did not say when the attack happened or how long the hacker was in its systems. Nor did it reveal how many people and businesses were impacted.
Cyberattacks have become more common as hackers grow more sophisticated and more transactions take place online.
The attack is the latest headache for Grubhub. In December, the company agreed to pay $25 million to settle an FTC investigation that accused it of deceptive business practices. And it has been losing market share to competitors DoorDash and Uber Eats for years.
Grubhub is now owned by Wonder, the fast-growing food hall/delivery concept founded by entrepreneur Marc Lore.
Members help make our journalism possible. Become a Restaurant Business member today and unlock exclusive benefits, including unlimited access to all of our content. Sign up here.