Breach Disclosure: Chowbus

The Asian food delivery service, Chowbus, experienced a data breach sometime before October 5, 2020. On October 5th, the hackers sent all customers an email containing two CSV files containing user and restaurant data. The exposed data included names, phone numbers, commission rates, and addresses for 4,300 restaurants that partner with Chowbus, along with email addresses, names, phone numbers, and addresses of 803,350 Chowbus users.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Sometime before the hackers sent out the email containing the restaurant and customer data on October 5th, hackers were able to compromise Chowbus and download both the user and restaurant data from their systems. The hackers then sent an email out from Chowbus email accounts (Analyst Note: it is unknown if this email was sent from a legitimate Chowbus account or spoofed since we do not have an original copy of the email sent to victims) to all customers with links to the restaurant and user data.

Figure 1: Email sent from hackers to Chowbus customers

Below are screenshots for samples of data uploaded by a user on Reddit who had identified the hack before news outlets picked the breach up.

Figure 2: Sample of restaurant data

Figure 3: Sample of Chowbus user data

Luckily for users of the service, no financial information was contained in the user database as all payments and processing are handled by Stripe. In a message from the CEO of Chowbus, they acknowledged the breach and stated that they immediately started to work to resolve the issues, however, no statement as to how the breach happened.