Supply chain
⛓ Supply Chain
GrubHub Third-Party Breach (February 2025)
Primary Source ↗Incident Details
GrubHub data breach impacts customers, drivers, and merchants. Food delivery company GrubHub disclosed a data breach impacting the personal information of an undisclosed number of customers, merchants, and drivers after attackers breached its systems using a service provider account. “Our investigation found that the intrusion originated with an account belonging to a third-party service provider that provided support services to Grubhub,” the company said on Monday. “We immediately terminated the account’s access and removed the service provider from our systems altogether.”.
Technical Details
- Initial Attack Vector
- Compromise of third-party service provider / vendor relationship
- Vendor / Product
- Third-party vendor
- Supply Chain Attack
- ✅ Confirmed third-party / vendor compromise
Timeline
- 2025-02-01 Breach occurred
- 2025-02-04 Publicly disclosed