Grubhub Data Breach and ShinyHunters Extortion Tied to Stolen Salesforce/Zendesk Data

Grubhub confirmed that unauthorized actors downloaded data from some of its internal systems and that the company is now facing extortion demands. Grubhub said it investigated and stopped the activity and stated that sensitive information such as financial data and order history was not impacted; it also engaged a third-party cybersecurity firm and notified law enforcement. Sources cited in reporting attribute the extortion attempt to ShinyHunters, with the threat actors allegedly demanding Bitcoin to prevent publication of data.

According to sources, the extortion leverages both older Salesforce data tied to a February 2025 incident and newer data allegedly taken from Zendesk, which Grubhub uses for customer support chat. Reporting also links the intrusion to follow-on activity stemming from the broader Salesloft Drift-related credential/OAuth token theft activity, where compromised tokens for Salesloft’s Salesforce integration were used to harvest credentials and secrets for subsequent attacks against downstream services. Separately, Monroe University disclosed a distinct 2024 network breach affecting ~320,000 individuals; it is unrelated to the Grubhub incident and involves theft of extensive personal, financial, and health data.