Security Now: GrubHub Breach, Short-Lived Certificates and Privacy Developments

Summary

Security Now discusses GrubHub's confirmed data theft and reported extortion, new short-lived Let's Encrypt certificates, vehicle-data privacy enforcement, and funding for Python package security.

Key points

• GrubHub confirmed that unauthorized individuals downloaded data from some systems and said it stopped the activity. Bleeping Computer sources reported that Shiny Hunters was extorting the company.
• Sources told Bleeping Computer that the GrubHub breach involved credentials stolen in the Salesloft Drift data theft attacks. GrubHub said financial information and order history were not affected.
• Let's Encrypt made opt-in certificates valid for 160 hours generally available. Its IP-address certificates must use the short-lived profile.
• The FTC finalized an order settling allegations that GM and OnStar collected and sold location and driving data without informed consent. It includes consent, access, deletion and opt-out requirements.
• Anthropic committed $1.5 million over two years to the Python Software Foundation, including planned automated review of package uploads and a known-malware dataset.
• Cyber Scoop reported that a proposed critical-infrastructure information-sharing body would replace CIPAC, but liability protections remained unresolved.
• The hosts discussed reported German draft legislation that would expand the BND's surveillance and hacking powers; the legislation was described as pending.

Indicators of compromise

People