- A hacker is selling Uber Eats customer data on a dark web forum – they claim to have 95 million records.
- This info allegedly includes names, delivery addresses, order histories, as well as payment details.
- There is no official report that Uber suffered any breach recently, so it’s uncertain whether the alleged data comes from an old breach or is fabricated to gain attention.
A threat actor advertised what they claim is a database of millions of Uber Eats users for sale on a dark web forum. The seller reportedly claims that the data contains lots of customer accounts and delivery details. But here is the big catch: nobody has proven this data is real yet.
What the Seller Claims to have
The seller says they have over 95 million records. Apparently, this database includes all sorts of customer account information and delivery details too.
Furthermore, the fields in the database supposedly include user ID, email address and password hashes. There’s also a full name, phone number & gender. Then there’s account type, delivery addresses, labels on those addresses, notes the driver has left, city, postal code & country. It even includes latitude and longitude coordinates, account creation date, and last order timestamp.
The seller also claims they have the total number of orders each user has made, their average order size, and what sort of food they like best.
In addition, the post stated that the actor obtained user payment details, currency, as well as payment provider. Also, the list allegedly includes users’ device information, what operating system they use, the Uber Eats app version on their phones, and whether the account is active or not.
If this data is real, it could create detailed profiles of individual users. Delivery addresses and location data could reveal sensitive info about where users live. Order history and food preferences might seem minor.
But criminals often combine this with data from other breaches. They use it to build detailed profiles for identity fraud or social engineering attacks. Payment metadata could help attackers craft more convincing scams too. This is true even if full payment card numbers are not included.
The listing mentions password hashes, not plain-text passwords. But this data can still be valuable to attackers. It all depends on how well Uber protects those passwords.
No Proof of a New Uber Eats Hack
While there have been many instances of data breaches involving Uber in the past, there’s no report of any fresh incident. Right now, there is no public proof linking this advertised database to a real Uber Eats breach.
No one has independently checked any technical samples. But there is no evidence of any forensic clues, breach reports, or official statements from Uber to suggest this data actually came from a hack of their systems. Uber hasn’t put out a statement saying there was any kind of breach of its system.
This isn’t Uber’s first rodeo with cyberattacks; the company faced a similar situation in September 2022. At the time, Uber confirmed a data breach, but said there was “no evidence at all” that users’ personal info was at risk.
The company brought all internal software tools back online after taking them down as a precaution. They also told the law.
The company clarified that its services, Uber, Uber Eats, Uber Freight, and the Uber Driver app, remained operational. Uber advised users never to make any changes to their accounts when there’s no apparent risk.
These warnings matter because cybercrime forums are full of fake database sale claims. Some listings contain recycled data from older breaches. Others combine information from multiple public leaks. Sometimes sellers exaggerate record counts. Sometimes, these threat actors advertise datasets that they don’t even have.
95 million is basically Uber Eats’ total active worldwide, so the claim could be a deliberate attempt to bloat the figure to attract buyers. Security researchers note that hackers frequently scrape large databases.
They label them with the names of popular services to attract buyers. Without technical verification, we cannot tell if this listing represents a real breach or a scam.
What Uber Eats Users Should Do Right Now
Since the claim is unverified, Uber Eats users do not need to panic. But this incident serves as a good reminder to follow basic account security steps.
Users should create a unique password for Uber Eats. In addition to this, they must activate multi-factor authentication on every platform where it is offered. The security features for accounts such as multi-factor verification, ensure that no unauthorized access can be gained.
Users should watch for unexpected password reset emails. Be cautious of messages that appear to be coming from Uber and want you to release personal or payment details.
Be on the lookout for weird orders by checking your order history from time to time. Notice anything off? Report to customer service ASAP. And one more thing, Uber will never send you any message asking for your password or one-time passcode.
For now, there’s nothing proving the so-called database sale is real. It is simply a claim posted on a cybercrime forum. Until researchers validate sample data or Uber confirms an incident, there is no evidence that the platform has experienced a breach.
Cybersecurity analysts will likely continue examining any samples that emerge in the coming days. For now, treat this news carefully. Claims involving major companies often change as more evidence becomes available.
The Uber Eats claim joins a growing list of unverified data sales, from delivery platforms to banks like Bank Jatim, hackers continue to flood dark web markets with claims requiring careful scrutiny.
