Uber Freight Investigates Breach After Helix Claims Theft of Nearly 1 Million Files

Uber Freight said it is investigating a data security incident involving unauthorized access to parts of its systems and repositories after the Helix extortion group listed the company on its leak site and claimed to have posted nearly 1 million files online. Reports said the alleged haul included data from mailboxes, OneDrive accounts, and the accounts receivable department, although Uber Freight did not confirm the authenticity of the leaked material. The company said the intrusion was identified, contained, and remediated, and that business operations were not disrupted.

Uber Freight also said it had engaged federal law enforcement as the incident drew links to a wider campaign targeting prominent U.S. companies. Researchers cited in the reports tied Helix to a broader extortion ecosystem associated with BlackFile and the UNC6671 cluster, which has been linked to credential theft through vishing and device-code phishing and to follow-on access into cloud services such as Microsoft 365 and, in some cases, Okta environments.