HungerRush Confirms Email-Service Breach After Extortion Emails to Restaurant Customers
Summary
HungerRush says an attacker used a third-party vendor’s compromised credentials to access its email marketing service and customer contact details, then send unauthorized extortion emails. The company says passwords and payment data were not exposed.
Key points
- Restaurant patrons received extortion emails warning that restaurant and customer data could be exposed; a later message claimed access to millions of records.
- Email-header analysis found the messages were sent through Twilio SendGrid and passed authentication checks for HungerRush’s domain.
- HungerRush confirmed an incident and said it notified law enforcement.
- The company says compromised credentials belonging to a third-party vendor were used to access its email marketing service and customer contact information, including names, email and mailing addresses, and phone numbers.
- HungerRush disputes the threat actor’s claims that passwords, dates of birth, Social Security numbers, or payment card information were exposed, and says it has no evidence other systems were compromised.
- The company says the incident was unrelated to an alleged employee infostealer infection and disabled access to the affected email service while its investigation continues.
Article Details
- Victim Organization
- HungerRush
- Victim Domain
- hungerrush.com
- Incident Type
- Breach of HungerRush's email marketing service account using a third-party vendor's compromised credentials, followed by unauthorized extortion emails.
- Incident Date
- 2026-03-04
- Disclosure Date
- 2026-03-04
- Data Types Exposed
- Names
- Email addresses
- Mailing addresses
- Phone numbers
- Affected Records
- No count disclosed. The threat actor claimed access to records for millions of customers; HungerRush disputed claims that sensitive personal or financial information was exposed.
- Operational Impact
- Unauthorized emails were sent to certain merchants and consumers using customer contact information. HungerRush disabled access to the affected email service as a precaution while investigating. The company said there was no evidence that other systems were compromised.
- Ransom Or Extortion
- The threat actor sent extortion emails demanding a response and threatening to expose data. No ransom amount or payment was reported.
- Claim Status
- confirmed