Supply chain ⛓ Supply Chain

GrubHub Third-Party Breach (February 2025)

📅 2025-02-01 🏢 Third-party vendor
Primary Source ↗

Incident Details

GrubHub data breach impacts customers, drivers, and merchants. ​Food delivery company GrubHub disclosed a data breach impacting the personal information of an undisclosed number of customers, merchants, and drivers after attackers breached its systems using a service provider account. “Our investigation found that the intrusion originated with an account belonging to a third-party service provider that provided support services to Grubhub,” the company said on Monday. “We immediately terminated the account’s access and removed the service provider from our systems altogether.”.

Technical Details

Initial Attack Vector
Compromise of third-party service provider / vendor relationship
Vendor / Product
Third-party vendor
Supply Chain Attack
✅ Confirmed third-party / vendor compromise

Timeline

  1. 2025-02-01 Breach occurred
  2. 2025-02-04 Publicly disclosed