Breach at food delivery service Chowbus reportedly affects hundreds of thousands of customers

The incident is a blow for a budding company that had recently attracted funding from Silicon Valley and New York venture firms alike.

Two months after securing a $33 million funding round from investors, food delivery startup Chowbus is grappling with a breach that observers say exposed personal data on hundreds of thousands of customers.

Customers reported receiving an email on Monday from Chowbus containing reams of customer data, including names, phone numbers and mailing and email addresses. The file is said to contain more than 800,000 rows.

The incident is a blow for a budding company that had recently attracted funding from Silicon Valley and New York venture firms alike. Founded four years ago in Chicago, Chowbus touts its app’s ability to connect diners with authentic and undiscovered Asian restaurants.

In an email to customers, Chowbus CEO Linxin Wen said the data had been “illegally accessed” and dumped online, but he did not say how. Credit card numbers were not compromised, Wen said.

“As soon as we became aware of this incident, our security team quickly took steps to start addressing the issue,” Wen wrote. He did not say what those steps were.

Have I Been Pwned, a data breach reporting service, said the data included 444,000 unique email addresses. Fifty-eight percent of the total dataset was already reported compromised by Have I Been Pwned.

Chowbus did not respond to requests for comment on Tuesday.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure