Uber Freight is looking into a cyber incident following claims by hackers of a leak involving millions of files.

      Uber Freight is looking into a data-security issue related to unauthorized access to some of its systems, the company announced on Tuesday, five days after a hacking group claimed to have uploaded approximately a million of its files online.

      In a statement from spokesperson Sam Hallock, the company reported that there has been "no impact to Uber Freight’s business operations, which continue normally without any disruption" and assured that "our systems are secure and fully operational." Hallock indicated that the incident has been "identified, contained, and resolved," and that the company has "promptly involved federal law enforcement."

      Additionally, Hallock did not confirm whether the released data was genuine or disclose when the hackers first made contact. Uber Freight has neither validated nor denied the assertion that a million files were compromised. The claim was made on August 6 by a group called Helix, one of four aliases tracked under the designation UNC6671 by Google’s Threat Intelligence Group, along with Falcon, Pink, and Redact.

      On the same day, Google published research on the group, detailing a voice-phishing scheme where callers impersonate IT personnel to gain access to large financial institutions. They identified Apollo Global Management, Bain Capital, Blackstone, Bridgewater, CME Group, KKR, Moody’s, and TPG as targets, demanding ransoms ranging from $750,000 to $3 million.

      Google's research does not mention Uber or Uber Freight, and the connection to the campaign is solely based on the Helix name. Researchers from Google indicated that the group's methods rely on social engineering rather than technical breaches, as callers convince employees to allow access or reset credentials.

      One cryptocurrency wallet associated with the campaign received approximately $10 million in bitcoin earlier this year. There has been no independent verification of the leaked data, and no specialized security outlets have reported on the incident as of this writing.

      Uber Freight brokers freight, offers transportation-management software, and manages transportation for shippers, which means its systems contain contract, pricing, and carrier information, although the specifics of what was taken remain unclear. It is not known if any personal data related to drivers, employees, or customers has been compromised, and there is no indication that Uber's ride-hailing or delivery services have been impacted.

      Uber Freight is a subsidiary of Uber Technologies that was established in 2017 and expanded through the $2.25 billion acquisition of Transplace in 2021. It reported $1.583 billion in revenue for the second quarter of this year, marking a 25% increase, while posting an operating loss of $24 million.

      In October 2024, Uber bought out Greenbriar Equity’s stake for $851 million, four years after the private-equity firm led a $500 million investment that valued the unit at $3.3 billion. The unit has grown rapidly through acquisitions and now manages freight for large shippers across North America, but it has not yet achieved profitability in any quarter since the Transplace acquisition. Uber does not provide detailed results for Uber Freight in its earnings reports.

      Uber has a complicated history concerning breach disclosures. The company concealed a breach in 2016 that affected 57 million users and drivers, paying the hackers $100,000. It settled with all 50 US states and the District of Columbia for $148 million in 2018, and its former chief security officer, Joe Sullivan, was convicted in 2022 and sentenced to three years' probation in 2023 for his role in the cover-up.

      Separately, in 2024, the Dutch data protection authority fined Uber €290 million for transferring driver data to the US. Uber has not submitted a securities disclosure specifically related to the incident, and no significant movements in share price have been linked to it.