Third-Party Access Risk: What the Grubhub Breach Teaches Small Businesses

Grubhub reported unusual activity tied to an account used by a third-party service provider for customer support. The company ended that access and removed the provider from its systems. Exposed data included names, email addresses, phone numbers, partial payment card details (card type and last four digits) and hashed passwords from certain legacy systems. Grubhub advised customers to watch their statements, change passwords and be alert for phishing.

Why this matters beyond Grubhub

Many small businesses also let outside parties reach their systems: an accounting firm, a software vendor, a phone provider, a contractor. Each one is a possible way in if its account is compromised.

Controls for vendor and contractor access

• Keep a list of every outside party with access and what they can reach.
• Give each person their own account, not a shared login, and require multi-factor authentication.
• Grant least privilege: only the systems and data needed for the job.
• Set an end date: disable accounts when the work ends.
• Log and review activity for unusual sign-ins.
• Put expectations in contracts, including breach notification.

If your data may be involved in a breach

Change affected passwords, turn on MFA, watch accounts and treat unexpected messages that mention the incident as possible phishing.

Related reading

• managed cybersecurity for Portland businesses
• Your cybersecurity is only as strong as your weakest vendor
• Supply chain attacks and managed IT

Talk to a local team

PDX Information Technology Services provides managed IT, cybersecurity and compliance support for small businesses in Portland, Lake Oswego, Beaverton, Hillsboro and Vancouver, WA. Plans start at $100 per user per month (Gold) and $180 per user per month (Platinum). Call 971-331-4871 or book a free assessment.