Loading story…
Grubhub confirmed that unauthorized actors downloaded data from some of its internal systems and that the company is now facing extortion demands. Grubhub said it investigated and stopped the activity and stated that sensitive information such as financial data and order history was not impacted; it also engaged a third-party cybersecurity firm and notified law enforcement. Sources cited in reporting attribute the extortion attempt to ShinyHunters, with the threat actors allegedly demanding Bitcoin to prevent publication of data.
According to sources, the extortion leverages both older Salesforce data tied to a February 2025 incident and newer data allegedly taken from Zendesk, which Grubhub uses for customer support chat. Reporting also links the intrusion to follow-on activity stemming from the broader Salesloft Drift-related credential/OAuth token theft activity, where compromised tokens for Salesloft’s Salesforce integration were used to harvest credentials and secrets for subsequent attacks against downstream services. Separately, Monroe University disclosed a distinct 2024 network breach affecting ~320,000 individuals; it is unrelated to the Grubhub incident and involves theft of extensive personal, financial, and health data.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Sources said Grubhub was facing extortion demands tied to an alleged ShinyHunters operation threatening to release both the older Salesforce data from the February 2025 breach and the newer Zendesk data from the recent incident. This attribution and extortion detail emerged in reporting after the breach confirmation.
Grubhub publicly confirmed the data breach, said it quickly investigated and stopped the unauthorized activity, and began working with a third-party cybersecurity firm. The company also said it notified law enforcement and was taking steps to improve security.
In a more recent incident before Grubhub's January 2026 disclosure, unauthorized actors downloaded data from certain Grubhub internal systems, including newer Zendesk data according to reporting. Grubhub said financial information and order history were not affected.
In February 2025, Grubhub was reportedly affected by a breach involving older Salesforce data. The incident was linked to broader Salesloft/Drift-related data theft activity that abused stolen OAuth tokens for Salesloft’s Salesforce integration.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Charter Communications confirmed a data breach after **ShinyHunters** threatened to leak allegedly stolen data, with the group claiming it accessed the company on April 1 through a voice-phishing attack that compromised an employee's Microsoft Entra account and opened a path into Charter's Salesforce environment. The attackers said they stole **40 million customer records**, including names, contact details, plan information, support ticket data, and some customer proprietary network information, while Charter said it notified authorities and, based on the data published, no sensitive personal information or CPNI was exfiltrated. The Charter incident follows a broader ShinyHunters extortion campaign targeting enterprise single sign-on accounts and connected SaaS platforms, especially **Salesforce**. In a separate case, the group claimed it stole several terabytes of data from **ZenBusiness** via platforms including Salesforce, Snowflake, and Mixpanel, and threatened to publish the data unless the company responded. Reporting also linked the campaign to claims involving Ameriprise Financial, Infinite Campus, Bumble, Hinge, Match, OkCupid, Mercer Advisors, Beacon Pointe Advisors, and attacks affecting Instructure's Canvas platform, underscoring a repeatable pattern of social engineering, SaaS data theft, and leak-site extortion.
Jun 29, 2026
Brinks Home disclosed that attackers gained unauthorized access to part of its IT environment and are threatening to leak allegedly stolen data, while extortion group **ShinyHunters** has claimed responsibility for the intrusion. The company said it detected the incident on July 20 and immediately began incident response, adding that its alarm monitoring operations, products, and core system functionality were not affected based on current findings. ShinyHunters alleges it accessed Brinks Home on July 13 through a Microsoft Entra voice-phishing attack and exfiltrated more than **4.9 million** Salesforce records, including some employee personally identifiable information, customer support chat logs, and other data from the company’s Salesforce environment. Brinks Home said it is still determining exactly what information was involved and which individuals may be affected, and warned customers that threat actors may use the incident to send fraudulent messages impersonating Brinks Home or its response partners.
Aug 10, 2026
**CarGurus** customer data was published online in a leak attributed to the **ShinyHunters** extortion group, exposing roughly **12.4–12.5 million** accounts. A **6.1GB** archive was posted and subsequently ingested by *Have I Been Pwned* (HIBP) after validation checks; HIBP reported the dataset includes **email addresses, IP addresses, full names, phone numbers, physical addresses, user account IDs**, and additional sensitive business/transactional fields such as **finance pre-qualification application data, finance application outcomes, dealer account details, subscription information**, and account ID mappings. HIBP indicated about **70%** of the data had appeared in prior breaches already tracked by the service, implying roughly **3.7 million** records may be newly exposed; the public availability of the dataset increases risk of **targeted phishing and fraud** using the enriched identity and financing-related attributes. CarGurus had not publicly confirmed the incident at the time of reporting and did not respond to media requests, while HIBP and reporting attributed the breach to ShinyHunters, a group known for **social engineering/vishing-style** intrusions and subsequent extortion/leak tactics. Separate ShinyHunters-linked incidents reported in the same period included **Wynn Resorts** confirming theft of employee data following an extortion threat, and **Optimizely** disclosing a breach tied to a **voice-phishing** attack that exposed limited business contact information; these are distinct events and do not change the core CarGurus exposure but reinforce the group’s ongoing operational tempo and reliance on social engineering to obtain access and data for leverage.
Jun 29, 2026