Uber Freight: Helix Extortion Claim and Confirmed Unauthorized Access

Uber Freight has confirmed it is investigating a data security incident involving unauthorized access to a portion of its systems and repositories, days after a data-extortion crew operating as "Helix" posted what it claimed were nearly 1 million files stolen from the logistics subsidiary. Company spokesperson Sam Hallock said on Tuesday, August 11, 2026, that the incident was "identified, contained and remediated," that Uber Freight "promptly engaged federal law enforcement," and that there has been "no impact to Uber Freight's business operations, which continue in the normal course without disruption." Hallock declined to say whether the posted data was authentic, when the company learned of the breach from the attackers, or whether Uber Freight interacted with them. The volume figure circulating publicly, roughly 1 million files, comes from the threat actor's own leak post and has not been confirmed by Uber Freight or by any independent examination reported in the sources reviewed here.

What Happened

Helix listed the victim on its leak site on August 6, 2026, according to Reuters reporting carried by CNA. Threat intelligence monitoring service ThreatMon flagged the listing on August 7 under the name "Uber" rather than "Uber Freight," per Undercode News, which noted at the time that the claim was an unverified allegation with no public confirmation from the company. Uber Freight's confirmation followed on August 11. So the timeline is: leak post first, monitoring pickup second, corporate acknowledgment roughly five days later.

The company's own framing and third-party financial coverage diverge. Uber Freight told Reuters there was no operational impact. Simply Wall St, an investor-focused outlet, characterized the event as "material to its cybersecurity and operational risk profile" and said the company "continues to assess potential exposure of data connected to Uber Freight operations." That materiality language is the outlet's characterization, not a quoted company statement or a filed regulatory disclosure in any source reviewed here, and it should not be read as an SEC materiality determination. Uber Technologies stock closed at $78.54 on August 11, up 0.65 percent, with no visible incident-driven move.

Two items in the wider source pool need to be actively separated out, because both will pollute keyword searches on this incident:

A different company. The Darkfield victim record for "ubfreight.com," listed by the m3rx ransomware group on July 22, 2026, refers to UB Freight, a New Zealand air and sea freight forwarder in Auckland founded in 2001. That is a distinct organization and a distinct actor. There is nothing in the sourcing to connect it to Uber Freight or to Helix.

A different incident. Mitiga's incident-response log analysis of an "Uber cybersecurity incident" describes the September 2022 compromise of Uber's internal tooling via social engineering and a Thycotic PAM takeover. It is a four-year-old event, republished with a July 2026 update stamp, and is unrelated to the Helix claim.

What Was Taken

Confirmed by the victim: unauthorized access to "a portion" of Uber Freight systems and repositories. That is the extent of what Uber Freight has said publicly. The company has not published a record count, a data-type inventory, or a customer or driver notification.

Claimed by the attacker: nearly 1 million files, posted to Helix's leak site on August 6. There are no competing volume figures across the sources, because there is only one figure, and it is the extortionist's. Notably, the claim is expressed in files rather than in individual records or affected persons, which is the pattern you would expect from a bulk SharePoint or document-repository grab rather than from a structured database dump. The word "repositories" in Uber Freight's own statement is consistent with that shape.

Data sensitivity in a freight brokerage context is worth stating even without confirmation, because it drives the downstream risk: carrier and shipper contracts, rate confirmations, load tenders, insurance certificates, driver and carrier onboarding paperwork, and customer commercial terms. None of that is confirmed as exposed here. It is what an intruder in a logistics document repository would plausibly reach.

Why It Matters

Helix is not an isolated actor. Reuters reported on August 6 that Uber was one of dozens of prominent U.S. businesses and financial institutions hit in a recent spate of extortion attempts, and Google Threat Intelligence said in an August 6 blog post that Helix is one of several names attached to a single cluster of high-profile intrusion activity against a wide swath of major companies. A blog analysis at trustingodmore.com asserts the same campaign has touched Blackstone, Bridgewater Associates, and Levi Strauss. That specific victim list appears in only one low-confidence source and should be treated as unverified until a primary or established-press outlet corroborates it.

The strategic read for defenders: this is pure data-theft extortion, not encryption. There is no ransomware payload in the reported behavior despite the "ransomware group" label applied by some trackers. Business continuity was never the leverage. The leverage is publication. That means the usual resilience controls, backups, failover, recovery time objectives, buy you nothing here, and an organization can be fully operational, as Uber Freight says it is, while still facing the entire loss.

Second, the containment claim and the leak claim are not in conflict, and defenders should not read "contained and remediated" as "no data left the building." An intrusion can be closed out days after exfiltration completed. Nothing in Uber Freight's statement addresses whether the posted files are genuine.

Third, freight brokerage sits at a supply chain junction. A compromise there exposes counterparty data belonging to shippers and carriers who were never themselves breached, which is why downstream partners should be asking questions now rather than waiting for a notification that may never name them.

The Attack Technique

Uber Freight has not disclosed an initial access vector. The best-sourced technical profile of Helix comes from BleepingComputer's July 9, 2026 reporting on ReliaQuest research, and it describes an identity-first playbook with a very distinctive exfiltration fingerprint:

• Vishing for initial contact. Operators call employees while impersonating their manager, using either the manager's name or caller ID spoofing to establish legitimacy.
• Device code phishing. The call steers the target into a device-code authorization flow, handing the operator a valid session without ever touching a password.
• MFA abuse for persistence. Once inside, operators immediately register a new MFA authenticator app on the account, surviving password resets.
• SharePoint enumeration and bulk collection. ReliaQuest calls this Helix's strongest technical signature and says the behavior was identical across incidents. Enumeration ran from 179.43.185[.]230 with the python-requests/2.28.1 user agent. The operator issued contentclass:STS_Site and wildcard (*) SharePoint searches to inventory every reachable item, then bulk-downloaded from the same IP and user agent.

Stolen data is then used to extort the victim under threat of publication, or sold on to other criminals. ReliaQuest assesses that Helix emerged from the ShinyHunters and BlackFile extortion groups based on overlapping tradecraft and infrastructure, while stating it found no definitive connection. Organizations that confirmed breaches previously claimed by ShinyHunters in the preceding month include Medtronic, Nissan, NAIC, Kodak, Infinite Campus, and Nottingham University.

To be explicit about the gap: no source ties this specific tradecraft to the Uber Freight intrusion. It is the actor's established pattern, and Uber Freight's reference to compromised "repositories" is consistent with it, but the vector at Uber Freight remains undisclosed.

What Organizations Should Do

1. Hunt for the exfiltration fingerprint now. Query SharePoint Online and Unified Audit Log data for SearchQueryPerformed events containing contentclass:STS_Site or bare wildcard queries, for the python-requests/2.28.1 user agent on any authenticated session, and for connections from 179.43.185[.]230. Look back at least 90 days, not just to the date you started worrying.
2. Kill device code flow where it is not needed. Entra ID Conditional Access supports blocking the device code grant by policy. Most enterprises use it for a handful of shared devices and IoT scenarios, and can deny it everywhere else. This closes the primary Helix entry path outright.
3. Alert on MFA method registration, not just MFA failures. A new authenticator app registered minutes after a successful sign-in from an unusual location or client is the single highest-signal detection for this playbook. Route it to a human, not to a dashboard.
4. Train the help desk and staff against manager-impersonation vishing. The attack works because a phone call from "your manager" defeats controls that a phishing email would not. Establish a callback verification procedure through a known-good directory number for any request involving a login code, a device approval, or an MFA change, and make it acceptable to use it on an executive.
5. Rate-limit and monitor bulk document retrieval. Set thresholds for how many files one identity can pull from a SharePoint or document repository in a window, and alert on breach of that threshold. Bulk collection is the step between access and extortion leverage, and it is the last place to catch it.
6. Build the extortion playbook before you need it. Because there is no encryption event to force the issue, decision-making happens under a publication deadline instead. Pre-agree who authorizes law enforcement engagement, who validates whether leaked samples are authentic, how counterparties named in stolen documents get notified, and what the public statement says. Uber Freight's engagement of federal law enforcement and its same-day operational reassurance are a reasonable template for the first 24 hours.

Sources: Uber Freight says its investigating cyber incident following hacker... | New Helix vishing group emerges in SharePoint data theft attacks | Uber freight says no impact to business operations due to data ... | Uber (UBER) Is Investigating A Cyber Incident At Uber Freight - Sim... | ubfreight.com data breach — M3Rx ransomware leak (2026) · Darkfield | Uber Freight Hacked? Inside the Cyber Attack and Data Breach (2026) | Helix Ransomware Group Claims Uber as a Victim While Storm Targets... | Uber Cybersecurity Incident: Which Logs Do IR Teams Need to Focus On?