The Target: ​Food delivery company GrubHub.
The Take: GrubHub said that, depending on the affected individual, the attackers gained access to names, email addresses, and phone numbers, as well as partial payment card information (including card type and last four digits of the card number) for some campus diners.
The Vector: The investigation found that the intrusion originated with an account belonging to a third-party service provider that provided support services to Grubhub.
This breach is a stark reminder of how strong authentication controls are in an overall robust cybersecurity posture, and that good password hygiene plays a pivotal role in protection.