Grubhub was hit by a data breach that compromised account information for a certain set of customers. Revealing the breach earlier this week, the food delivery service said that the attacker exploited an account belonging to a third party that provided support for the company. In response, Grubhub deleted the account's access and removed the provider from its systems.

Customer data in breach

Caught up in the breach were the names, email addresses, phone numbers, and the card type and last four digits of the payment cards used by Grubhub campus diners, as well as diners, merchants, and drivers who used its customer care service. The campus dining program is one in which students use the service to order food both on and off campus. Grubhub offers dedicated help and support services for different types of users.

Also: Proton Pass vs. 1Password: Which password manager is right for you?

The attacker also retrieved hashed passwords for certain legacy systems, prompting Grubhub to change any passwords that may have been accessed.

However, the company said that no sensitive personal information was compromised in the breach. That includes Grubhub Marketplace customer passwords, merchant login information, full payment card numbers, bank account details, and Social Security or driver's license numbers.

How Grubhub responded to the breach

To respond to the breach and to try to prevent future incidents, Grubhub said it took the following steps:

• Contacted forensic experts.Called a third-party cybersecurity firm to conduct a full investigation.
• Strengthened credential security.Rotated all relevant passwords to stop any unauthorized access.
• Enhanced monitoring.Set up additional anomaly detection for internal services.

Also: 7 ways to get more out of your Bitwarden password manager

"We recently identified a security incident involving a third-party contractor, resulting in unauthorized access to certain user contact information," Grubhub said in its notice. "We took immediate action to contain the situation and have worked with leading forensic experts to investigate the matter. We are confident that the incident has been fully contained."

Change your password

Though the breach seems confined to a small subset of users, Grubhub customers might still want to change their passwords to be safe. To do that, sign into the website  or mobile app, go to your Account page, select the setting for Password, enter your current password and a new password, and then save the change.

Security

The best VPN services of 2024: Expert tested

How to turn on Private DNS Mode on Android (and why you should)

The best antivirus software and apps you can buy

The best VPN routers you can buy

How to find and remove spyware from your phone

• The best VPN services of 2024: Expert tested
• How to turn on Private DNS Mode on Android (and why you should)
• The best antivirus software and apps you can buy
• The best VPN routers you can buy
• How to find and remove spyware from your phone