Uber Freight probes data breach after Helix extortion group leaks millions of files

Uber Freight announced that it is investigating a data security incident after the Helix extortion collective listed the company on its leak site, claiming to have taken almost a million files from various corporate repositories, including mailboxes and OneDrive accounts. The firm stated that the intrusion was detected, isolated and corrected, and that it promptly engaged federal law enforcement. Uber Freight emphasized that the breach has not disrupted its regular business activities and that its platforms remain secure and operational.

Helix is linked to the UNC6671 cluster, which researchers say uses shared infrastructure with other extortion brands such as Pink, Redact and Falcon. The group typically gains access through vishing and device-code phishing targeting cloud services like Microsoft 365 and identity providers such as Okta. Recent activity from UNC6671 has shifted toward high-value sectors like technology, transportation and hospitality. The incident highlights ongoing threats to large logistics networks and the broader supply chain.