"They're selling YOUR Uber passwords"

Two vendors on a relatively new Dark Web marketplace are selling active Uber usernames and passwords.

On Saturday, Ars verified that "Courvoisier" is claiming to sell these logins for $1 each on the AlphaBay Market, which launched in late 2014. Another vendor, "ThinkingForward," sells the same items for $5 each.

As Courvoisier writes: "The credentials provided will be a valid login for the Uber website for which you can use to order phones from completely free. (You can find the guide in our store if you're unaware on the how-to)."

According to the listing (Tor, AlphaMarket login required), he or she has sold 131 such logins since March 18.

Ars attempted to contact the two vendors but they did not immediately respond.

In an interview with Motherboard, one vendor claimed to have "thousands" for sale, and even provided a sample of them. As the site reported Friday:

Motherboard reached out to one of the users whose email address and password was put up for sale: James Allan, sales director for OISG, a technology solutions company.

Allan confirmed that the username and password Motherboard had seen were correct, as well as the expiry date on his personal credit card. He doesn’t actually use Uber anymore, and the last trip he booked was in December 2013.

"Bloody hell," Allan said over the phone, when he was told what his password was.

He was "extremely surprised" by the revelation, he said. Allan also said that he doesn’t use the internet much for financial transactions, preferring cash "for this very reason."

In a statement e-mailed to Ars on Saturday morning, Uber spokeswoman Trina Smith said that the company did not find evidence of a breach.

"Attempting to fraudulently access or sell accounts is illegal and we notified the authorities about this report," Smith wrote. "This is a good opportunity to remind people to use strong and unique usernames and passwords and to avoid reusing the same credentials across multiple sites and services."