Grubhub Breach: Data Theft Confirmed, Extortion Suspected
Published
Key Takeaways
- Unauthorized Access: Grubhub has officially acknowledged that unauthorized individuals accessed and downloaded data from its systems.
- Extortion Attempts Reported: ShinyHunters may be extorting Grubhub, threatening to release data allegedly stolen from Zendesk and Salesforce instances.
- Third-Party Involvement: The breach is reportedly linked to compromised credentials from a third-party vendor, possibly stemming from recent Salesloft Drift data theft.
The food delivery giant has confirmed a significant Grubhub data breach, stating that unauthorized actors accessed its systems and downloaded internal data. While the company has not publicly disclosed the exact scope or timeline of the incident, it has engaged a third-party cybersecurity firm and notified law enforcement.Â
Grubhub Acknowledges Cybersecurity Incident
In a statement, Grubhub emphasized that sensitive customer financial information and order histories were not affected by the intrusion. "We're aware of unauthorized individuals who recently downloaded data from certain Grubhub systems," the company told BleepingComputer.
However, the lack of transparency regarding the specific data types compromised raises concerns about potential downstream attacks.Â
ShinyHunters Extortion and Third-Party Risks
Intelligence from sources indicates that the threat actor group ShinyHunters may be behind the attack and is actively extorting the company. The group is reportedly demanding a Bitcoin payment to prevent the leak of data allegedly stolen from Grubhub's Zendesk support system and older Salesforce records.Â
Reports suggest the data breach may have originated from stolen credentials linked to the Salesloft Drift attacks in August 2025, where threat actors harvested OAuth tokens to infiltrate Salesforce instances across multiple organizations, with ShinyHunters claiming almost 1,000 victims.
In October, Google’s Mandiant said the UNC6395 threat actor specifically targeted Amazon Web Services (AWS) access keys (AKIA identifiers), Snowflake-related access tokens, and login URL strings.Â
Implications for Enterprise Security
Organizations must rigorously audit third-party access privileges and rotate secrets immediately upon suspicion of compromise.Â
For Grubhub, the breach follows a recent wave of scam emails originating from its own subdomains, further complicating the platform's and its users' security landscape, and it suffered a data breach in February 2025.
The exploitation of third-party integrations, such as customer support platforms and CRM systems, remains a favored vector for sophisticated threat actors.Â
This week, JPMorgan disclosed a supply chain breach at a law firm that impacts over 650 investors. Last month, ShinyHunters extorted Pornhub after premium users’ data was exposed due to an alleged third-party breach at Mixpanel.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.
Most Popular