2022Social engineeringData breach
Uber internal systems breach
September 2022
An attacker used a contractor's corporate password, which Uber said was likely bought on the dark web after malware infected the contractor's personal device. The attacker repeatedly triggered two-factor login requests until the contractor accepted one, then reached other employee accounts and internal tools such as Slack and G Suite.
- Victim
- Uber
- Sector
- Technology (transport)
- Public attribution
- Uber said it believed the attacker was affiliated with the Lapsus$ group.Lapsus$ profile
Impact
Access to several internal tools and systems; Uber said it was working with the FBI and the US Department of Justice.
Root cause
Stolen credentials combined with push-based MFA that a tired or confused user could approve (MFA fatigue).
Lessons learned: the controls it teaches
- Use phishing-resistant MFA, or at least number matching, instead of simple push approvals.
- Alert on repeated MFA prompts for the same account.
- Keep work credentials off personal, unmanaged devices.