A Phone Call Stole a Million Logistics Files
Uber Freight confirmed on August 12 that it is investigating a significant data breach triggered by social engineering. The Helix extortion group claims to have stolen nearly a million documents from one of North America's largest managed-transportation platforms. Their method was strikingly simple: someone called an Uber Freight helpdesk, impersonated IT staff, and obtained system access to customer and operational data. No sophisticated exploit. No advanced persistent threat. Just a phone call and the assumption of good faith.
For a company built on digitizing freight logistics and eliminating paper, the irony cuts deep. The breach was not prevented by clever security architecture; it was enabled by the oldest vulnerability in any organization: someone trusting a voice on the line without verification. If you work in supply chain, that should feel uncomfortably familiar.
What "A Million Files" Means for Canadian Importers
Uber Freight's platform is a Transportation Management System (TMS) that handles PARS (Pre-Arrival Review System) submissions from customs brokers, pre-arrival reviews with CBSA, customs clearance authorizations, release documentation, driver credentials, shipper records, and billing data. When the company reports a million stolen documents, that includes:
- PARS submissions and pre-arrival review data sent by Canadian customs brokers ahead of shipment arrival at ports
- CBSA release authorizations and release-on-minimum-documentation (RMD) directives from customs clearance
- Driver identity information, DOT and cross-border permits, carrier safety credentials, and insurance details
- Shipper names, customs bond account numbers, declared values, and duty payment records tied to importers
- Container numbers, cargo descriptions, tracking data, weights, and billing details for thousands of shipments
- Logistics partner login credentials, API access keys, and standing authorization tokens for integrated 3PLs and forwarders
For a sufferance warehouse like FENGYE LOGISTICS or any 3PL receiving inbound shipments through brokers using Uber Freight's platform, this breach creates three immediate and concrete dock-level risks.
First, a fraudster or competitor with these documents may submit forged PARS or release documents to a warehouse dock claiming ownership of cargo. Without verification, warehouse staff may release the shipment to the wrong party, creating liability for the actual importer and for the 3PL.
Second, if shipper and driver identity data are exposed and compromised, a warehouse cannot reliably verify who the legitimate owner of a shipment is or who is authorized to pick it up. This creates compliance risk with CBSA bonded warehouse regulations and potential duty and drawback disputes.
Third, if customs account numbers and bond information are stolen, bad actors or competitors can file claims against legitimate importers' customs bonds, trigger demand letters, or initiate recovery actions that lock up duty accounts for weeks.
Why Brokers and Forwarders Are Soft Targets
Social engineering works in logistics because the industry is built on trust and time pressure. When someone calls a customs broker's helpdesk claiming to be from IT support and asks for a TMS login or API token, the person answering is trained to be cooperative and fast. They do not typically ask for multi-factor confirmation, employee ID verification, or call back a separate known number. They give it up because the asker sounds credible and the workflow is urgent.
Most Canadian customs brokers and freight forwarders do not enforce multi-factor authentication (MFA) on their PARS portals or release databases. Many outsource IT support to third-party contractors who have standing access to production systems but receive minimal background vetting beyond a basic check. Most do not audit or log who accessed PARS data, release templates, or shipper records on a daily or hourly basis. Audit trail infrastructure is expensive and not mandated by regulation.
That is not negligence; it is typical for smaller and mid-market operations. A regional brokerage in Toronto with 20 staff cannot afford a dedicated security operations center the way Uber Freight (backed by billions in venture capital) can. But smaller size means lower barriers to social engineering. A caller claiming to be from "head office IT" is more plausible at a company with 3 to 5 IT staff than at Uber.
The lesson is brutal: if a billion-dollar platform with investor-backed infrastructure falls to a phone call, a regional broker will fall faster. And when a broker is compromised, the 3PL and warehouse downstream are exposed by default.
The Dock Impact When a Broker Is Breached
Our dock-to-stock SLA at FENGYE is 48 hours on clean PARS data. When a security breach introduces forged releases or fraudulent access into the system, that timeline collapses immediately.
Scenario: A drayage driver arrives at our dock with a release document that looks authentic, complete with broker letterhead, customs signatures, and CBSA stamp images. But the release was created by a fraudster using stolen broker credentials and templates. Our receiving staff processes the shipment based on the document. Twenty-four hours later, the real broker calls asking why their customer's shipment was released to the wrong party. We have now created liability for the importer, exposed our bonded warehouse license to CBSA scrutiny, and created a claim dispute.
Or: A PARS arrives in our system from a broker's account claiming duty-free CUSMA-eligible cargo. The container sits in our inbound queue. Two days later, CBSA does a spot-check and finds the PARS metadata has been altered. The release document is flagged. CBSA holds the shipment for a full examination, which stretches to 3–5 days. By that time, the Port of Montreal is charging detention at commercial rates, and the importer's next-day outbound window is blown.
For a cross-dock operation, that means absorbing warehousing costs we cannot bill back, plus cascade delays through the next day's outbound commitments. For an importer with just-in-time manufacturing, it means production line stalls.
Why Identity Verification Is Now Mandatory
At FENGYE LOGISTICS, our in-bond cargo handling services now include mandatory identity verification for every inbound PARS and release before any cargo movement. Here is how we do it.
For every arriving shipment, we call the customs broker directly using a phone number retrieved from our internal broker database, not a number provided in the email or on the release document. We do not use the number on the customs release letterhead, because that can be forged. We ask the broker specific questions about the shipment: the importer's name, the shipper's name, the commodity description, the duty amount, and the expected arrival time. Only the broker handling that file would know all four answers.
For high-value shipments or new brokers, we cross-reference the broker against Transport Canada's customs brokerage registry to confirm they are licensed and active. We also spot-check release documents against a whitelist of known broker contact information, so we can detect if a phone number or address has been altered.
If a PARS arrives from a broker's account but the cargo type, duty amount, or shipper name does not match patterns from that broker's previous shipments, we flag it for verbal re-confirmation before we accept it. Yes, this adds 30–60 minutes to the dock-to-stock cycle. But it eliminates fraud and avoids the downstream costs of a forged release.
This is not foolproof. But it beats the default model: receive a release, scan it, move the cargo, and hope no one was lying.
What Canadian Importers Should Demand From Their Brokers Now
After the Uber Freight breach, importers have every right to ask their logistics partners three direct, non-negotiable questions.
First: "How do you verify that a PARS or release document is authentic before you act on it?" If the answer is "we trust the system" or "we assume TMS data is secure," that is not acceptable. Push back. The correct answer should include at least three elements: (1) phone verification to a known broker number (not the one on the document), (2) digital signature validation or metadata audit to detect tampering, and (3) a documented audit trail showing who accessed and approved the release in your system.
Second: "What is your incident response and notification protocol if your TMS is compromised?" The answer should specify a maximum notification timeline (24 hours is industry standard for material breaches). It should outline a plan to revoke and reissue PARS for all in-transit shipments if the TMS is compromised. And it should clearly state who bears the cost of detention, customs exams, and warehousing delays incurred due to the breach, or if the broker has cyber liability insurance that covers importers.
Third: "Do you enforce multi-factor authentication on all access to PARS submissions, release documents, and shipper data portals?" If the answer is no, ask why not. MFA is standard practice in banking and e-commerce. Logistics custodies customs data and handles high-value transactions. The security bar should match or exceed finance.
Related: Upstream supply chain disruption cascades to your dock
Related: Why AI Dock Automation Fails Without Clear Metrics
Related: Supply Chain Insurance Premiums Spike; Dock Cycles Tighten
The Threat Is Trust Collapse
The Uber Freight breach does not mean TMS platforms are inherently unsafe or that the internet is broken. It means one company failed to implement basic identity verification controls and is now exposed. The real threat is contagion: once a fraudster has a collection of legitimate-looking PARS and release documents, they can target smaller forwarders and 3PLs who do not verify by default.
For importers receiving shipments at the Port of Montreal or moving goods on the 401 corridor, the message is direct. Do not assume your broker's security posture is robust just because they have been in business for 10 years. Do not assume your 3PL validates releases automatically; ask them how. Demand verification procedures. Demand audit trails. Demand transparent incident response. A phone call got inside a billion-dollar company because someone trusted a voice on the line. That same voice can reach your dock and compromise your shipment if you do not push back.
Originally published at https://www.fywarehouse.com/news/uber-freight-breach-your-brokers-phone-line-is-now-a-dock-risk-14bef0bb.
