Grubhub-branded Holiday Crypto Promotion email campaign
Campaign
Summary
Hide ▲
Show ▼
Fraudulent Grubhub-branded emails began circulating on December 24 and promised a 10x Bitcoin payout, creating an active fraud risk for merchant partners and recipients. The messages were sent from a legitimate b.grubhub.com subdomain and used sender names that appeared to come from Grubhub. They also included the recipient’s name, increasing the credibility of the scam. Grubhub said it isolated the problem and is working to prevent a repeat.
Related Happenings
Nordstrom hit by network compromise
Incident
First: 18.03.2026 15:55
Last: 18.03.2026 15:55
Sources 1
About this happening:
**Nordstrom** suffered an **email-system compromise** that let unauthorized **cryptocurrency scam** messages reach **customers** from a legitimate sender address, creating a direc...
Nordstrom hit by network compromise
IncidentAbout this happening: **Nordstrom** suffered an **email-system compromise** that let unauthorized **cryptocurrency scam** messages reach **customers** from a legitimate sender address, creating a direc...
Grubhub Salesforce and Zendesk data extortion leak
Data Leak
First: 15.01.2026 23:38
Last: 15.01.2026 23:38
Sources 1
About this happening:
**Grubhub** is facing a **data leak extortion** attempt after stolen **Salesforce** and **Zendesk** data were tied to a **February 2025 breach** and a more recent compromise. The...
Grubhub Salesforce and Zendesk data extortion leak
Data LeakAbout this happening: **Grubhub** is facing a **data leak extortion** attempt after stolen **Salesforce** and **Zendesk** data were tied to a **February 2025 breach** and a more recent compromise. The...
Timeline
-
26.12.2025 22:22 2 articles · 5mo ago
Grubhub-branded crypto scam emails begin
Initial DisclosureFraudulent emails using the legitimate b.grubhub.com subdomain begin reaching Grubhub users and merchant partners, including messages from [email protected] and [email protected] that promote a Holiday Crypto Promotion and promise a 10x Bitcoin payout for funds sent to a specified wallet; some messages include the recipient’s name.
Show sources
- Fake GrubHub emails promise tenfold return on sent cryptocurrency — www.bleepingcomputer.com — 26.12.2025 22:22
- Fake GrubHub emails promise tenfold return on sent cryptocurrency — www.bleepingcomputer.com — 26.12.2025 22:22
-
26.12.2025 22:22 1 articles · 5mo ago
Grubhub says it isolated the unauthorized messages
Untyped PhaseGrubhub says it identified unauthorized messages sent to some merchant partners, isolated the problem, and is taking steps to prevent the abuse from happening again.
Show sources
- Fake GrubHub emails promise tenfold return on sent cryptocurrency — www.bleepingcomputer.com — 26.12.2025 22:22