The vendor, Teqtivity, which helps manage
and track information technology equipment such as phones and computers, on
Monday confirmed the cyberattack.
More than 77,000 Uber employees' email
addresses and other data, including alleged source code associated with mobile
device management platforms used by Uber and Uber Eats, have been leaked as
part of the recent hack, according to a report from Bleeping Computer, which
covers information security and technology news.
“We believe these files are related to an
incident at a third-party vendor and are unrelated to our security incident in
September,” said Carissa Simons, the Uber spokesperson. “Based on our initial
review of the information available, the code is not owned by Uber; however, we
are continuing to look into this matter.”
Teqtivity said in a statement it doesn't
collect or store sensitive information such as bank account details or
government identification numbers. The exposed data includes device information
such as serial number, make and model as well as user information such as full
name, work email address and location.
Teqtivity said customer data was
compromised due to unauthorized access to its systems by a malicious third
party. The hacker was was able to gain access to the Teqtivity AWS backup
server that houses the company's code and data files related to its customers,
according to the company
Teqtivity has notified law enforcement
officials and hired a forensics firm to investigate all logs and server
configuration.
The leak is the latest breach to affect
Uber. Uber said the attackers (or attacker) responsible for a September breach
were affiliated with the notorious extortion group called Lapsus$ and had
likely infected a contractor's personal device with malware and then bought
that person's password on the dark web.
In that instance, the intruders were able
to get into several employee accounts and had security permissions for Uber's
G-Suite and Slack, among other internal tools.
In October, former Uber security chief Joe
Sullivan was found guilty of hiding a massive 2016 data breach from federal
regulators ©Bloomberg LP