HungerRush: vendor’s stolen credentials used to hijack its SendGrid marketing account and mass-mail extortion emails to restaurant patrons

What happened

• HungerRush (POS platform for 16,000+ restaurants) said a third-party vendor’s compromised credentials were used to breach its email marketing service account, and patrons’ names, emails, mailing addresses and phone numbers were accessed and used to send extortion emails from support@hungerrush.com via Twilio SendGrid. It disputes the attacker’s claims of passwords, dates of birth and card data. Count not disclosed; the attacker claims millions.
• Root cause: compromised third-party vendor credentials for the email marketing (SendGrid) account; the emails passed SPF, DKIM and DMARC because HungerRush’s SPF record authorizes SendGrid.
• Unidentified attacker.
• Email service disabled; law enforcement notified.

Sources

• https://www.bleepingcomputer.com/news/security/hacker-mass-mails-hungerrush-extortion-emails-to-restaurant-patrons/
• https://www.cm-alliance.com/cybersecurity-blog/biggest-cyber-attacks-data-breaches-ransomware-attacks-of-march-2026

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.