A prominent extortion network has officially claimed responsibility for a targeted cyberattack against Uber Freight, the dedicated logistics division of the rideshare company. News of the security incident first broke via reports from Reuters, prompting official statements from corporate representatives. An Uber Freight spokesperson confirmed that the company launched an internal investigation to examine the intrusion allegations. The representative stated that the event created zero disruption to daily business operations, and core operational systems continue to run as expected.
Uber Freight now stands as the newest target in a string of corporate security incidents hitting major shipping networks, corporate finance houses, and private equity firms over recent weeks. Security researchers attribute these coordinated network intrusions to an extortion gang known as Helix. The threat group focuses on breaking into enterprise cloud storage setups, extracting massive volumes of internal files, and threatening public leaks if victims refuse ransom demands.
The Helix threat group published an update on its public leak site, claiming to possess stolen files from inside Uber Freight systems. According to their public post, stolen records include employee email mailboxes, cloud drive contents, financial documents related to accounts payable, and active freight dispatch logs. Early reviews of sample files released online show email exchanges between company personnel and commercial shipping clients. Dates on the leaked sample documents point to network activity taking place around mid-June.
Company officials have not confirmed whether the extortion group sent direct ransom notes, nor have they stated if any financial payments were made to keep records private. Security teams continue reviewing system logs to map out the exact scope of the incident and determine how deep attackers penetrated the internal network.
According to a threat report published by Google, the Helix syndicate forms part of a larger extortion collective tracked under the identifier UNC5671. The threat collective relies heavily on direct social engineering tricks rather than complex technical exploits. Attackers place direct calls to internal helpdesks, using voice phishing tactics to trick IT staff into resetting target user account passwords. While security analysts describe these social manipulation methods as basic, they prove extremely effective at bypassing standard defense systems and stealing high-level login credentials.
Google blockchain analysis shows that extortion wallets tied to this hacking umbrella collected at least $10.6 million in Bitcoin ransom payments between January and May of this year. As extortion networks keep targeting vital supply chain hubs, logistics managers must enforce strict verification steps for internal password resets to block fraudulent support calls and shield confidential shipping records.