Uber Freight investigating data security incident after Helix claims breach | brief

Uber Freight is investigating a data security incident after the extortion group Helix claimed to have stolen nearly 1 million files from the company's systems. The incident was identified, contained, and remediated, and federal law enforcement has been engaged, with further coverage provided by The Register.

The incident at Uber Freight, the logistics arm of the ride-sharing giant, comes after the Helix group listed the company on its data leak site on August 6, claiming to have accessed mailboxes, OneDrive accounts, and accounts receivable. An Uber Freight spokesperson stated that the breach has not disrupted daily operations and that systems remain secure and operational. Helix is linked to the UNC6671 activity cluster, which researchers say shares infrastructure with other extortion brands like Pink, Redact, and Falcon. This group has been observed using vishing and device code phishing to gain initial access, targeting cloud services and identity infrastructure.

Recently, UNC6671-linked groups have shifted their focus to higher-value sectors including technology, transportation, and hospitality, after previously targeting manufacturing, real estate, healthcare, and insurance. The fragmentation of these groups after the retirement of BlackFile may be a strategy to compartmentalize operations or due to internal disagreements, according to Google Threat Intelligence Group.