Third-Party Access Risk: What the Grubhub Breach Teaches Small Businesses
Last updated:
Grubhub reported unusual activity tied to an account used by a third-party service provider for customer support. The company ended that access and removed the provider from its systems. Exposed data included names, email addresses, phone numbers, partial payment card details (card type and last four digits) and hashed passwords from certain legacy systems. Grubhub advised customers to watch their statements, change passwords and be alert for phishing.
Why this matters beyond Grubhub
Many small businesses also let outside parties reach their systems: an accounting firm, a software vendor, a phone provider, a contractor. Each one is a possible way in if its account is compromised.
Controls for vendor and contractor access
- Keep a list of every outside party with access and what they can reach.
- Give each person their own account, not a shared login, and require multi-factor authentication.
- Grant least privilege: only the systems and data needed for the job.
- Set an end date: disable accounts when the work ends.
- Log and review activity for unusual sign-ins.
- Put expectations in contracts, including breach notification.
If your data may be involved in a breach
Change affected passwords, turn on MFA, watch accounts and treat unexpected messages that mention the incident as possible phishing.
Related reading
- managed cybersecurity for Portland businesses
- Your cybersecurity is only as strong as your weakest vendor
- Supply chain attacks and managed IT
Talk to a local team
PDX Information Technology Services provides managed IT, cybersecurity and compliance support for small businesses in Portland, Lake Oswego, Beaverton, Hillsboro and Vancouver, WA. Plans start at $100 per user per month (Gold) and $180 per user per month (Platinum). Call 971-331-4871 or book a free assessment.
Request an IT assessment
Tell us a little about your business and a PDX IT team member will follow up to schedule an assessment. Prefer to talk? Call 971-331-4871.
About the author: Steve Shaff
Steve Shaff is the owner of PDX Information Technology Services, a managed IT provider he founded in 2020. From the Tualatin office he helps businesses across Portland Metro & Southwest Washington with IT support, cybersecurity and compliance. More about Steve ยท Contact PDX IT
Infostealer malware copies saved passwords and live session cookies from a browser and sells them on the dark web, which lets attackers walk past MFA. Here’s how it works and a practical 10-step plan for Portland-area small businesses.
Modern ransomware gangs don’t just lock your files. They copy your data first, then threaten to publish or sell it on the dark web. Here is how double extortion works and what Portland-area small businesses can do before, during and after an attack.
Portland small business mobile security checklist: lock phones, avoid risky public Wi-Fi, secure office wireless, spot text scams and handle lost phones.