Retail & Fintech · Delivery · Structural / no discrete incident
Grubhub
Headline
Grubhub confirmed in January 2026 that unauthorized parties had downloaded data from certain of its systems; sources told BleepingComputer the ShinyHunters group was extorting the company with older Salesforce data and…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Grubhub confirmed in January 2026 that unauthorized parties had downloaded data from certain of its systems; sources told BleepingComputer the ShinyHunters group was extorting the company with older Salesforce data and newer Zendesk data and had used secrets stolen in the Salesloft Drift attacks (not confirmed by Grubhub) - which, if accurate, places this row inside the master cross-reference documented in the F500 Tech & Semiconductors tab: more than a thousand organisations reached through vishing and stolen OAuth tokens, with no zero-day or malware at any stage. Food delivery data is a home address plus a routine plus a dietary and health signal.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
ALLEGED BREACH / ACTIVE LITIGATION (current status not verified as of Oct 2026): Mintz v. Grubhub Holdings Inc. (Illinois federal court, filed about Jan. 19-20 2026) alleges Grubhub failed to protect sensitive personal data of diners and delivery drivers; a separate suit by a former employee (Bianchi, N.D. Ill., Jan. 2026) concerns a January 2025 breach of SSNs, addresses and financial data that Grubhub reportedly notified on Feb. 3 2025. The specific data categories (e.g., driver's license and vehicle-insurance data) were NOT verified this pass and remain allegations; if confirmed, the driver-specific data would fit the same 'gig workers carry more sensitive verification data than customers' pattern documented for TaskRabbit elsewhere in this tracker.
Fees and billing
A reported $7.15 million settlement over allegations that Grubhub listed restaurants on its platform without permission could NOT be verified this pass (allegations only; confirm before use).
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy grubhub.com/legal/privacy | Not fetched yet | NO (HTML only) |
| Terms of service grubhub.com/legal/terms | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.