Uber denies that its servers were hacked after reports that thousands of usernames and passwords for the taxi-like service are available to buy for as little as $1 online.
Two sellers with outlets on the AlphaBay Market dark web marketplace, hidden from the open internet within the Tor anonymity network, claim to sell stolen, working Uber credentials allowing purchasers to login and book rides.
According to the market place listing, one vendor has sold over 180 Uber logins since 18 March.
But Uber denies that the stolen logins came from its servers suggesting that users should avoid sharing the same login credentials across multiple sites.
“We investigated and found no evidence of a breach,” said an Uber spokesperson in a statement. “Attempting to fraudulently access or sell accounts is illegal and we notified the authorities about this report.”
Technology site Motherboard was able to verify that some of the stolen credentials were valid and included names, usernames, passwords, partial credit card numbers and telephone numbers for Uber users.
Uber has been criticised in the past for the way it handles customer data and the ability of staff to access a “god mode”, which allowed employees to track riders using the GPS in their smartphones and the Uber app.
The company changed its privacy policy and the way customer data was handled in response to outcry from BuzzFeed reporter Johana Bhuiyan, who claimed that an Uber executive had accessed her profile without her knowledge prior to a meeting.
Uber now enforces a “strict policy prohibiting all employees at every level from accessing a rider or driver’s data” except for “legitimate business purposes”, although what constitutes a business purpose is not defined.
Comments (…)
Sign in or create your Guardian account to join the discussion