On Friday, Motherboard revealed that fully functioning Uber accounts were for sale on the dark web. Today, it appears that some people have fallen victim to fraudulent trips being made with their login credentials.
"It happened this morning," Phil Turner, an apparent victim, told me in an email. "I got a notification on my phone from Uber saying 'your taxi was on its way/it arrived' etc., but thought it must be a glitch of the app."
It wasn't. Instead, Turner says he was told by an Uber representative that "I've checked your account details and it looks like someone has accessed your account illegitimately. We believe that your email account may have been hacked as access was gained to your account by sending a password reset link to your email." The representative then changed his password, sent him the new one, and suggested that he change it again himself, as well as the password on his email account.
In a statement issued following the initial news of stolen accounts being for sale, Uber said that it had found no evidence of a breach. The company told The Hill that the accounts for sale were unrelated to a 2014 hack.
Other people are taking to Twitter to complain about their Uber account being accessed, too.
A man named Elliott posted, "Would love an explanation as to why my Uber account has been hacked w/fraudulent trips being made!!" He then tweeted that he hasn't received a response from Uber in 48 hours.
Another apparent victim, Matthew Warriner, asked Uber "still no response?? My account has been hacked and money taken off my card. I expect someone to be in touch asap," and a third asked for the Uber UK contact number after also complaining of a hack.
Uber are reportedly issuing some victims with refunds. "[My account] has been used, definitely," David McGlashan told me in a Twitter message. "Uber have refunded the journeys, eventually."
Although the refund took between 24 and 48 hours, McGlashan feels that Uber only responded to him because "there were so many people" that had contacted the company about the hacking.
Last Friday afternoon, McGlashan received a text from Uber along with a new verification code which he hadn't requested. He was then unable to access his account, meaning that someone presumably had taken over it and changed the password.
"The customer service is shocking," McGlashan said, adding that Uber apparently said the account locked due to him "messing up the verification code."
On Saturday, McGlashan checked in with his bank, and there were four pending transactions to Uber, he told me. Once getting back into his Uber account, several journeys had been made in West London, in the Uxbridge area.
I was pointed to the tweets by "Just Aguy", a user of the uberpeople forum. "The only Twitter complaints seem to be from London [account] holders," he or she told me in a Twitter message.
On Friday when Motherboard first broke the story, the Uber accounts were being sold for as little as $1. One of the vendors, Courvoisier, has now increased his price to $4.48, according to International Business Times, undercutting another vendor, ThinkingForward, who is selling them off for $5.
Update: Uber sent Motherboard a statement. "We investigated this report and found no evidence of a breach on Uber systems. We've turned this over to the authorities and we will work with them as needed."