Uber Eats, the popular American online food ordering service, has found itself on the wrong side of cybersecurity after its user records were leaked on the dark web.
The news came hot in the heels of a discovery made by the third party cyber risk intelligence platform Cyble, which encountered the records through its well-known darknet and deep web monitoring project.
The experts from the cybersecurity company intimated the existence of nine TXT files that were leaked by a threat actor. The data dump is reported have critical info about Uber Eats delivery drivers, partner entities for the Uber Eats platform and customer data.
Specifically, the leaked files denote the login credentials of about 579 customers that use Uber Eats on a regular basis, while the sensitive info affecting delivery drivers include the individual full names, contacts, bank card info, login credentials and account creation dates as far as Uber Eats’ application is concerned.
At this point, the Cyble researchers have not verified whether the leaked data points out to a possible data breach suffered by the company. It can be assumed that the hackers harvested the sensitive information from third party apps and websites linked to Uber Eats users.
Uber Eats Advisory on Cyber Attacks
A quick scan through the Uber Help web page reveals a number of advisory tips issued to Uber Eats users concerning the currently volatile cybersecurity environment.
Uber Eats advises its users to look out for any suspicious activities that would easily point to the fact that they may have been hacked.
Contextually, the firm outlines the following pieces of advice to anyone “who thinks that their account may be hacked”:
-
The existence of order requests that were not made by a user, including complete orders that an Uber Eats user did not request. A threat actor’s activity becomes likely when such foreign order requests and complete orders arise.
-
All phone calls of text messages received by an Uber Eats user should be known to them. The occurrence of strange communication from delivery persons about orders that are foreign to an account holder will mean cyber trouble.
-
When a user received receipts for orders that are not recognizable to their account, it becomes likely that their Uber Eats account has been compromised.
-
The detection of any account changes, including payment profile changes, which were not sanctioned by the legitimate owner of an account will indicate the influence of an external threat actor.
-
A user should become worried if they encounter password and email address updates that happened without their knowledge or permission.
Some Cyber Safety Tips from Cyble
Notably, Cyble was the same organization that was first to report the April 2020 cybersecurity incident that affected the teleconferencing app Zoom – about 530,000 user credentials were sold on a darknet platform by a hacker for a shockingly meagre sum.
According to cybersecurity analysts, the large data dump contained sensitive files linked to the accounts belonging to notable institutions and organizations – including the Universities of Vermont, Colorado, Dartmouth, Florida, Lafayette, and firms such as Chase and Citibank.
The cyber event presented serious risks including the much-dreaded online eavesdropping that would potentially inflict significant economic damage to entire companies.
Further, Cyble is also credited with sounding an alarm on the cyber-attack suffered by Huiying Medical in the first quarter of 2020. It was reported that hackers stole COVID-19 medical data from the firm, which was then posted on the dark web for sale.
To understand the value of the stolen data, Huiying Medical’s marketing information had claimed that the AI algorithm affected by the data breach had been deployed across medical institutions globally – including twenty Chinese hospitals and ten countries.
Join us on Dread, Tape and Hotmilk forum
