Grubhub is investigating a security incident that exposed user data, including names, email addresses, and phone numbers.