Cyber Incident Victim: EatStreet
Date:
May 2019
Location:
United States of America
Summary
An online food ordering service experienced unauthorized database access by a hacker, compromising customer payment card details—including card numbers, expiration dates, verification codes, billing addresses, emails, and phone numbers—as well as sensitive partner data such as names, contact information, and banking details for delivery and restaurant affiliates. The company terminated the breach upon discovery, engaged external forensic experts to investigate, and confirmed no further unauthorized access. Security enhancements included multi-factor authentication, credential rotation, and coding practice updates. Payment processors were notified to mitigate risks, and notifications to affected parties were issued without law enforcement delays.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On May 3, 2019, an unauthorized third party gained access to EatStreet's database, compromising customer payment information and sensitive partner data. The breach remained undetected until May 17, 2019, when the company discovered the intrusion and promptly terminated the unauthorized access. The attacker exfiltrated information present in the database as of the intrusion date, including payment card details for a limited number of customers - specifically names, credit card numbers with expiration dates and verification codes, billing addresses, email addresses, and phone numbers. For delivery drivers and restaurant partners, the compromised data included names, addresses, phone numbers, email addresses, and critically, bank account and routing numbers. The company did not disclose the exact number of affected individuals but operated in over 1,100 cities with 15,000 restaurant partners, while its Android app had over 100,000 installations at the time of reporting.
EatStreet responded by engaging an external IT forensics firm to investigate the incident and conducted system audits to verify no additional unauthorized access occurred. The company implemented enhanced security measures including reinforced multi-factor authentication, credential key rotation, and coding practice reviews. Notifications were sent to affected customers and partners without law enforcement-related delays, while credit card processors received breach alerts to implement protective measures. The investigation remained ongoing at the time of disclosure, with no evidence found of further system compromises beyond the May 3 intrusion. EatStreet emphasized continuous collaboration with external security experts to strengthen its security controls following the breach.