Uber has revealed further information on a new data breach that saw information stolen through a third-party asset management and tracking services vendor, Teqtivity.

The company suffered a breach over the weekend (December 10th) after a threat actor leaked employee email addresses, corporate reports, and IT asset information stolen from a third-party vendor.

Going by the name ‘UberLeaks’, the hacker began stealing and then leaking data they claimed was stolen from Uber and Uber Eats on a hacking forum.

BleepingComputer research found that the newly leaked data consists of IT asset management reports, data destruction reports, Windows domain login names and email addresses for over 77,000 Uber employees.

The leaked data also included mobile device management platform (MDM) source code used by the firm and third-party vendor services.

Each post refers to a member of the Lapsus$ hacking group who is believed to be responsible for numerous high-profile attacks, including a September cyberattack on Uber.

According to a report from the New York Times in September, a hacker gained access to an Uber employee’s Slack account, then used the platform to notify other employees of the attack.

“I announce I am a hacker and Uber has suffered a data breach,” the Slack message read. The post ended with a claim that the company underpays drivers.

In a statement to BleepingComputer, Uber said: “We believe these files are related to an incident at a third-party vendor and are unrelated to our security incident in September. Based on our initial review of the information available, the code is not owned by Uber; however, we are continuing to look into this matter.”

Security researchers who analysed the leak said that the data is related to internal Uber corporate information and does not include any of its customers, according to BleepingComputer. However, it does contain enough detailed information to conduct targeted phishing attacks on Uber employees.

BleepingComputer has warned that employees should be on the lookout for phishing emails impersonating Uber IT support and confirm all information directly with IT admins before responding to such emails.

In response, a spokesperson for Uber said “We believe these files are related to an incident at a third-party vendor and are unrelated to our security incident in September. This vendor helps manage and track IT assets, like phones and computers.

“The vendor does not collect or store, and therefore the data does not include, sensitive personal information like bank account details or government identification numbers (e.g. SSNs, tax numbers), nor do they collect or store consumer, driver or courier information. We are continuing to look into this matter.”

Recommended

• Comment | Cybersecurity inevitabilities of 2023
• Edinburgh’s Green Bioactives LTD gains £2.6m seed funding
• DataVita taking extra measures to protect operations

Commenting on the breach, Ian McShane, VP Strategy at Arctic Wolf said: “In the recent years, we’ve seen that companies are becoming more at risk of being either the “target” or the “transport” that allows other organisations to be hacked.

“With this data breach, perhaps this kind of supply chain attack becomes the venn diagram where supply chain attacks meet targeted attacks. If this is truly a third-party MDM breach and wasn’t “just” off the back of some credentials/data stolen during the prior Uber incident, one assumes that there are other companies about to find out that their data was leaked through no fault of their own. I wouldn’t be surprised if we saw more incidents like this as we approach the new year.

“Although navigating instances like this can be overwhelming for businesses, this is a reminder that organisations need to understand who their suppliers are and try to minimise overlap and reduce the risk by keep an eye on the vendors in their environments. Vendor risk assessment is a critical aspect of any organisation’s security operations, and this must be a priority for 2023.”

Deryck Mitchelson, Field CISO at Check Point Software said: “The most recent Uber breach should act as a stark reminder that just because you’ve been targeted once, doesn’t mean you are now immune to another breach. Cybersecurity is a continuous journey of evaluation and action, and organizations cannot afford to let prevention slip down the priorities list.

“While it appears no customer data has been exposed, we should all be on high alert for a rapid influx of phishing emails, a type of social engineering tactic that we’re continuing to see time and time again. This is when hackers will use various outlets to lure users into handing over private data, including passwords or banking information.

“For businesses it’s critical that staff are made aware of this risk and taking advantage of current technologies that can keep companies protected by proactively guarding against these types of threats.”

Nigel Jones, co-founder, Privacy Compliance Hub, said: “If your data privacy house is in order, your biggest weakness is probably the people who work for the organisations with whom you share data. In this latest Uber case, the data was sitting on a vendor’s AWS server. It is therefore likely that the cause of this breach was human error. Businesses need to work harder to make sure that they can trust those organisations with which they are sharing data.”

This breach and the cyber-incident in September are not the only times that Uber has been in the news with organisational issues this year.

In July, the Uber Files were leaked to the Guardian, and shared with the International Consortium of Investigative Journalists, as well as several other media organisations.

Released files contained more than 124,000 records, including 83,000 emails and 1,000 other files involving conversations, spanning 2013 to 2017, raising several points of contention with regards to the app’s rise in Europe.

The leak reveals how Uber and its then chief executive, Travis Kalanick, went about embarking on a lobbying and public relations effort to disrupt Europe’s taxi industry.

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

To subscribe, click here.