Loading story…
Uber Freight said it is investigating a data security incident involving unauthorized access to parts of its systems and repositories after the Helix extortion group listed the company on its leak site and claimed to have posted nearly 1 million files online. Reports said the alleged haul included data from mailboxes, OneDrive accounts, and the accounts receivable department, although Uber Freight did not confirm the authenticity of the leaked material. The company said the intrusion was identified, contained, and remediated, and that business operations were not disrupted.
Uber Freight also said it had engaged federal law enforcement as the incident drew links to a wider campaign targeting prominent U.S. companies. Researchers cited in the reports tied Helix to a broader extortion ecosystem associated with BlackFile and the UNC6671 cluster, which has been linked to credential theft through vishing and device-code phishing and to follow-on access into cloud services such as Microsoft 365 and, in some cases, Okta environments.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
Reuters reported on August 6 that Uber was among dozens of prominent U.S. businesses and financial institutions targeted in recent extortion attempts. The report named firms including Blackstone, Bridgewater Associates, Apollo Global Management, Bain Capital, KKR, TPG, CME Group, Clearlake Capital, and Moody’s.
In an August 6 blog post, Google Threat Intelligence said Helix is one of several names associated with a cluster of high-profile hacking activity. Google said Helix shares infrastructure with other extortion brands and tracks the broader cluster as UNC6671.
On August 6, the Helix extortion group listed Uber Freight on its leak site and claimed to have posted nearly 1 million files. Helix said the material came from sources including mailboxes, OneDrive accounts, accounts receivable, and other repositories.
Researchers said that during April and May, UNC6671-linked brands focused on manufacturing, real estate, healthcare, and insurance, but since June they have favored technology, transportation, and hospitality targets. This contextual shift helps place Uber Freight within a broader targeting trend.
Researchers said the BlackFile extortion brand retired its name in May. Later reporting linked Helix to infrastructure associated with BlackFile.
Uber Freight disclosed that it is investigating a data security incident involving unauthorized access to part of its systems and repositories. The company said the incident was identified, contained, and remediated, federal law enforcement was engaged, and business operations were not disrupted.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
securitymagazine.com
Open sourcescworld.com
Open sourcetechcrunch.com
Open sourcetheregister.com
Open sourceteiss.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Uber disclosed that an attacker breached its internal environment after socially engineering a contractor and abusing push-based multi-factor authentication. According to Uber and multiple reports, the intruder used stolen credentials to access the company over VPN, then moved through internal resources including **Slack**, **Google Workspace**, Windows domain systems, AWS, VMware infrastructure, dashboards, and the company's **HackerOne** bug bounty account. The attacker reportedly found privileged credentials in internal scripts tied to privileged access management, enabling broader access to secrets and administrative systems. Uber said core services remained operational and that it found no evidence that sensitive customer data such as trip histories, credit card information, or cloud-stored user records were accessed, though internal Slack messages and finance-related files were downloaded. A particularly serious consequence was the exposure of Uber's private HackerOne submissions, raising the risk that unfixed vulnerabilities were revealed. Uber later said the activity was likely linked to a person associated with **LAPSUS$**, citing tactics similar to earlier intrusions at major technology firms, and said it was working with the FBI and DOJ while strengthening defenses against MFA fatigue and social-engineering attacks.
Jun 29, 2026
Grubhub confirmed that unauthorized actors downloaded data from some of its internal systems and that the company is now facing extortion demands. Grubhub said it investigated and stopped the activity and stated that *sensitive information* such as financial data and order history was not impacted; it also engaged a third-party cybersecurity firm and notified law enforcement. Sources cited in reporting attribute the extortion attempt to **ShinyHunters**, with the threat actors allegedly demanding Bitcoin to prevent publication of data. According to sources, the extortion leverages both older **Salesforce** data tied to a February 2025 incident and newer data allegedly taken from **Zendesk**, which Grubhub uses for customer support chat. Reporting also links the intrusion to follow-on activity stemming from the broader **Salesloft Drift**-related credential/OAuth token theft activity, where compromised tokens for Salesloft’s Salesforce integration were used to harvest credentials and secrets for subsequent attacks against downstream services. Separately, Monroe University disclosed a distinct 2024 network breach affecting ~320,000 individuals; it is unrelated to the Grubhub incident and involves theft of extensive personal, financial, and health data.
Jun 29, 2026
**LexisNexis Legal & Professional** confirmed that an unauthorized party accessed a limited number of its servers after a threat actor using the alias **FulcrumSec** leaked roughly **2 GB** of allegedly stolen files on underground forums. LexisNexis stated the exposed information was **mostly legacy/deprecated data from prior to 2020** (e.g., customer names, user IDs, business contact details, products used, customer survey data including respondent IP addresses, and support tickets) and said it found **no evidence of impact to products or services**; the company reported the matter to law enforcement and engaged an external forensics firm. FulcrumSec claimed the intrusion began by exploiting the **React2Shell** vulnerability in an **unpatched React frontend application** to gain access to LexisNexis’ **AWS** environment, and alleged broader access within cloud resources (including an ECS task role and data stores) and the presence of government-related accounts (e.g., `.gov` email addresses) in the stolen dataset. Public reporting notes a discrepancy between the actor’s claims (e.g., “millions of records,” passwords, and other internal artifacts) and LexisNexis’ characterization of the exposed data as limited and non-sensitive (no SSNs, financial data, active passwords, or customer search queries), but multiple outlets corroborated that the leaked files are tied to a real, now-contained incident affecting LexisNexis’ Legal & Professional division.
Jun 29, 2026