Hackers Hit Grubhub, Google, and Tesla This Week

If it felt like attackers were everywhere this week, that’s because they were. From a food delivery giant facing extortion to AI assistants leaking data and a quick takedown of a high-profile car infotainment system, the security storyline was uncomfortably consistent: accessible targets, valuable data, and fast-moving adversaries. Here’s what happened and why it matters.

Grubhub Breach Raises Ransom Stakes Amid Supply Chain Fallout

Grubhub confirmed a data breach tied to a wider third-party incident reportedly linked to Salesforce systems, with threat actors now packaging customer data and demanding payment. It’s a textbook supply-chain scenario: one weak link, many downstream victims. Even if a ransom is paid, stolen data often resurfaces later in criminal markets, a point reinforced by numerous past cases tracked by incident responders.

Practical takeaway:

• Reset your Grubhub password.
• Revoke suspicious app connections.
• Watch for phishing that name-drops recent orders or addresses.

Industry studies such as IBM’s Cost of a Data Breach report peg the average breach at roughly $4–5 million, and the true cost for consumers often arrives later via identity misuse and social engineering.

Headphone Tracking Flaw Exposes Fast Pair

Security researchers uncovered a vulnerability in Google’s Fast Pair protocol that could let attackers track and pair with supported Bluetooth headphones without permission. Because Fast Pair is embedded across popular models from Google, Sony, Jabra, Anker, and others, the exposure is broad. The flaw turns a convenience feature into a proximity beacon, effectively shrinking an attacker’s hunt for a target to a radius of a few meters.

Manufacturers are pushing firmware updates, so check your headphone companion app.

• Disable auto-pair prompts in public.
• Prune remembered devices on your phone.

Small hygiene steps blunt opportunistic abuse of protocols designed for speed over scrutiny.

AI Assistants Leak Data Through Clever Prompts

On the enterprise side, Varonis Threat Labs detailed “Reprompt,” a technique that bypassed Microsoft Copilot safeguards to pull sensitive information the assistant could access and preserve that access across sessions. Because Copilot runs server-side with memory, end users can’t easily see what data was exposed once a malicious sequence takes hold. Microsoft says new protections are in place and that corporate Microsoft 365 Copilot customers were not affected, but the episode underlines how fast adversaries iterate against AI guardrails.

Separately, researchers at Miggo demonstrated how a booby-trapped calendar invite can steer Google’s Gemini into exfiltrating private meeting summaries via calendar integration. It’s a smart twist on prompt injection: plant hidden instructions in a field the model trusts, then let automation do the rest. The advice here is straightforward—minimize unnecessary integrations, limit assistant access to only what it needs, and routinely review which data sources your AI tools can touch.

Tesla Infotainment Cracked in Hours at Security Contest

At a security competition, researchers broke into Tesla’s infotainment stack within hours, earning a $35,000 bounty. Beyond the headline, the signal is that complex, highly connected vehicles multiply attack surfaces—from browser engines and media parsers to Bluetooth stacks and app sandboxes. The good news: modern cars like Tesla can ship over-the-air fixes quickly, narrowing the window of exposure compared with older, dealer-only patch models.

Owners should still treat in-vehicle browsers and third-party streaming apps as potential risk zones.

• Pair fewer devices.
• Clear stored credentials.
• Apply updates promptly; in automotive systems, even “non-safety” bugs can become pivot points.

Google Faces COPPA Payout Over Ad Tracking

Regulators and litigants kept pressure on data practices, with Google agreeing to pay more than $8 million to settle allegations that its AdMob unit collected data from apps aimed at children, potentially violating COPPA. Google denies wrongdoing, but the episode echoes the 2019 settlement over YouTube’s child data collection. For developers, this is a reminder that ad SDK choices carry legal and reputational risk; for families, it reinforces why child profiles, stricter app permissions, and privacy-focused settings are worth the hassle.

Defenders Are Moving Too With Anti-Phishing Upgrades

Not all the arrows pointed one way. 1Password introduced a browser extension upgrade that flags lookalike domains before you paste credentials, adding a second line of phishing defense. LastPass warned users about a fresh phishing campaign targeting vault holders—timely, given that credential theft remains a top breach driver in annual reports from Verizon and others.

Layered defenses still win:

• Use phishing-resistant MFA where possible.
• Adopt passkeys for major services.
• Routinely check recovery methods so you’re not locked out when you replace a phone.

The Big Picture: Faster Patches, Tighter Integrations

This week connected the dots: a supply-chain breach cascaded into consumer risk; a convenience protocol traded privacy for speed; AI copilots proved powerful but porous; and embedded systems reminded us that modern software is everywhere—and so are bugs. The fix isn’t one silver bullet but faster patch pipelines, tighter integrations, and fewer standing permissions. In other words, shrink what attackers can see, limit what they can touch, and make it costly to linger. Until then, expect hackers to keep dining out.