Considering they have the plaintext passwords and that Uber can't identify a breach, it's most likely people who re-use the same password and were a victim of another hack (adobe et al.)