Uber Freight is currently conducting an internal investigation following claims from a cybercriminal organization that it successfully breached the logistics company’s systems. The hacking group, identified as Helix, alleges that it exfiltrated sensitive data, including internal mailboxes, cloud storage drives, accounts payable records, and dispatch documentation. While the group has posted samples of what it claims to be stolen files—some of which appear to contain email correspondence between the company and its clients—the authenticity of these documents remains unverified.

In response to the allegations, a spokesperson for Uber Freight confirmed that the company is aware of the situation but emphasized that its business operations remain unaffected and its systems are functioning normally. The company has not disclosed whether it has been contacted by the threat actors or if any ransom demands have been issued. The incident marks the latest in a series of high-profile attacks attributed to the Helix group, which has increasingly targeted transportation, finance, and private equity sectors throughout the year.

Security experts have linked the Helix group to a broader collective known as UNC6671, which frequently utilizes social engineering tactics such as voice phishing to compromise corporate networks. By impersonating employees and contacting IT helpdesks to request password resets, these attackers bypass traditional security perimeters. Recent analysis of the group’s cryptocurrency wallets suggests that these methods have been highly lucrative, with researchers estimating that the collective has secured at least $10.6 million in ransom payments during the first five months of the year.

Key Takeaways

• Uber Freight is investigating claims by the Helix hacking group that it breached the company's cloud environments and internal files.
• The hacking group, linked to the collective UNC6671, is known for using voice phishing and social engineering to gain unauthorized access to corporate systems.
• Despite the claims, Uber Freight reports that its core business operations remain stable and fully functional.

Editor’s Analysis & Impact

The incident involving Uber Freight highlights a growing trend where logistics and supply chain entities are becoming primary targets for sophisticated extortion groups. The reliance on social engineering—specifically voice phishing—demonstrates that even companies with robust cloud security can be compromised through human-centric vulnerabilities. The fact that the Helix group has successfully extorted over $10 million in a short timeframe underscores the profitability of the ‘ransomware-as-a-service’ model and the persistent threat posed by groups like UNC6671. Moving forward, organizations must prioritize employee training regarding helpdesk authentication protocols and implement multi-factor authentication that is resistant to phishing. As these groups continue to evolve their tactics, the industry should expect increased scrutiny on the security of third-party logistics providers, which often serve as critical nodes in global supply chains.

Frequently Asked Questions

Q: What is the primary method used by the Helix hacking group to gain access?
A: The group primarily uses social engineering tactics, such as voice phishing, where they call IT helpdesks to trick staff into resetting passwords or granting unauthorized access.

Q: Has Uber Freight confirmed that a data breach occurred?
A: Uber Freight has acknowledged the claims and is investigating, but they have stated that their business operations are currently running normally and have not verified the authenticity of the leaked files.