Grubhub data breach confirmed amid extortion demands from hackers

Food delivery platform Grubhub has confirmed a recent data breach after unauthorized actors gained access to parts of its internal systems.

The statement comes as sources told BleepingComputer that the company is now facing extortion claims linked to stolen data.

In a statement to BleepingComputer, Grubhub said it quickly detected and stopped the activity.

“We are aware of unauthorized individuals who have recently downloaded data from certain Grubhub systems,” the company said. “We quickly investigated, shut down the activity, and are taking steps to further enhance our security posture.”

Grubhub added that sensitive information such as financial details or order history was not affected. However, the company refused to answer questions about when the breach occurred, whether customer data was involved or whether it was actively extorted.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent safety alerts and special deals straight to your inbox. You’ll also get instant access to my Ultimate Scam Survival Guide – free when you join my channel CYBERGUY.COM bulletin.

RANSOMWARE ATTACK EXPOSES SOCIAL SECURITY NUMBERS ON MAJOR GAS STATION CHAIN

What Grubhub has confirmed so far

Although details remain limited, Grubhub confirmed a few key points. He engaged a third-party cybersecurity firm and notified law enforcement. Beyond that, the company has remained largely silent. This lack of detail has raised concerns, especially given Grubhub’s recent security history. Just last month, the company was linked to fraudulent emails sent from its b.grubhub.com subdomain. These messages promoted a cryptocurrency scam promising huge returns from Bitcoin payments. Grubhub said it had the incident under control and blocked any further unauthorized emails. It was not clear whether the two incidents were related.

Sources attribute the breach to extortion by ShinyHunters

According to multiple sources cited by BleepingComputer, the ShinyHunters hacking group is behind the extortion attempt. The group has not commented publicly on the allegations and declined to respond when contacted. Sources say the attackers demanded Bitcoin payments to prevent the stolen data from being revealed. This data reportedly includes old Salesforce records from a February 2025 breach and newer Zendesk data taken during the most recent attack. Grubhub uses Zendesk to run its online customer support system. This platform handles ordering issues, account access, and billing-related questions, making it a valuable target for attackers.

How might stolen credentials have made the attack possible?

Investigators believe the breach may be linked to credentials stolen during previous Salesloft Drift attacks. In August 2025, threat actors used OAuth tokens stolen from Salesloft’s Salesforce integration to access sensitive systems over a ten-day period. According to a report from the Google Threat Intelligence Group, also known as Mandiant, attackers used the stolen data to launch tracking attacks across multiple platforms. “GTIG observed that UNC6395 targeted sensitive credentials such as AWS access keys, passwords, and Snowflake-related access tokens,” Google said. ShinyHunters previously claimed responsibility for this campaign and stated that it stole approximately 1.5 billion records from Salesforce environments connected to hundreds of companies.

Why does this breach still matter?

Even if payment data and order history are not affected, support systems often contain personal details. Names, email addresses, and account notes can be enough to fuel phishing attacks or identity scams. More importantly, this incident shows that old breaches can continue to cause damage long after the initial attack. Stolen credentials that are never modified remain a powerful entry point for threat actors.

Ways to stay safe after Grubhub data breach

If you use Grubhub or any online delivery service, a few smart steps can reduce your risk after a breach.

1) Update your password and stop reusing it

Start by changing your Grubhub password now. Make sure you don’t reuse this password anywhere else. Reused passwords give attackers easy access to other accounts. A password manager can help here. It creates strong, unique logins and stores them securely so you don’t have to remember them all.

Next, see if your email has been subject to past breaches. Our #1 password manager pick includes a built-in breach scanner that checks to see if your email address or passwords appear in known leaks. If you find a match, immediately replace reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2026 at: cyberguy.com.

ILLINOIS DHS DATA BREACH EXPOSES RECORDS OF 700 THOUSAND PEOPLE

The food delivery platform said it quickly stopped the attack but did not disclose when the breach occurred or whether customers were targeted. (Photo: Leonardo Munoz/VIEWpress)

2) Turn on two-factor authentication

Two-factor authentication is (2FA) if available, enable it. This adds a second step, such as a code sent to your phone or app when you sign in. Even if a hacker steals your password, two-factor authentication can prevent them from getting in.

3) Monitor phishing attempts closely and use strong antivirus software

Be wary of emails or texts that mention orders, refunds, or support issues. Attackers often use stolen support data to make messages appear urgent and genuine. Do not click on links or open attachments unless you are sure they are legitimate. Strong antivirus software can also help block malicious links and downloads before they can do harm.

The best way to protect yourself from malicious links that install malware and potentially access your private information is to have strong antivirus software installed on all your devices. This protection also keeps your personal information and digital assets safe by alerting you to phishing emails and ransomware scams.

Get my picks for the 2026 winners for the best antivirus protection for your Windows, Mac, Android, and iOS devices at: cyberguy.com.

4) Remove your data from people search sites

Consider using a data removal service to reduce your online footprint. These services help remove your personal information from data broker sites that attackers often use to create profiles. Less exposed data means fewer tools for fraudsters to use.

While no service can guarantee complete removal of your data from the internet, a data removal service is truly a smart choice. They’re not cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically deleting your personal information from hundreds of websites. This is what gives me peace of mind and has proven to be the most effective way to delete your personal data from the internet. By limiting the information available, you reduce the risk of fraudsters cross-referencing data obtained from breaches with information they can find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and run a free scan to see if your personal information is already on the internet by visiting: cyberguy.com.

Take advantage of free scanning to find out if your personal information is already on the internet: cyberguy.com.

5) Ignore crypto messages using trusted brands

Be skeptical of any cryptocurrency offers tied to companies you know. Grubhub has previously been linked to scam emails promoting crypto schemes; This shows how often attackers misuse trusted names. Legitimate companies won’t promise quick turnarounds or pressure you to take immediate action.

6) Monitor your Grubhub account and email activity

Check your Grubhub account to see if there’s anything unfamiliar. Watch out for unexpected password reset emails, order confirmations, or support messages you didn’t request. Attackers often silently test stolen data before making bigger moves.

7) Secure the email linked to your Grubhub account

Your email account is the key to password reset. Change this password and enable two-factor authentication if it is not already on. If attackers control your email, they can regain access to your email even if you change your other passwords.

8) Be alert for breach-related delay scams

Breach data is often reused weeks or months later. Phishing attempts can occur long after the headlines have disappeared. Be extra careful with future messages claiming to address Grubhub support, refunds, or account issues.

These steps won’t undo a breach, but they can limit how attackers exploit stolen information and reduce your risk going forward.

FIBER BROADBAND GIANT INVESTIGATES VIOLATIONS AFFECTING 1 MILLION USERS

Sources told BleepingComputer that the Grubhub breach was linked to extortion claims involving allegedly stolen customer support data. (Gabby Jones/Bloomberg via Getty Images)

Kurt’s important takeaways

Grubhub’s approval puts the official stamp on what sources have been warning about for weeks. Although the company says sensitive data was not affected, there are unanswered questions. As extortion-related breaches increase, transparency and rapid credential rotation become more important than ever. What stands out most is how past compromises continue to create new risks. Once access tokens survive for too long, attackers don’t need to break in again. They just come back through an open door.

If companies remain silent after breaches, how can customers know when it’s time to protect themselves? Let us know by writing to us. cyberguy.com.

CLICK TO DOWNLOAD FOX NEWS APPLICATION

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent safety alerts and special deals straight to your inbox. You’ll also get instant access to my Ultimate Scam Survival Guide – free when you join my channel CYBERGUY.COM bulletin.

Copyright 2026 CyberGuy.com. All rights reserved.