Uber Data Breach

In September 2022, Uber suffered a major security breach when a teenager affiliated with the Lapsus$ hacking group gained access to the company's internal systems. The attacker accessed Slack, Google Workspace, source code repositories, and internal dashboards.

What Happened

On September 15, 2022, an 18-year-old hacker affiliated with the Lapsus$ group compromised an Uber contractor's account through an MFA fatigue attack, repeatedly sending push notification requests until the contractor accepted one. Once inside the VPN, the attacker found hardcoded credentials in a PowerShell script that gave them access to Uber's privileged access management system (Thycotic). From there, the hacker gained broad access to multiple internal systems including Slack, HackerOne bug bounty reports, source code, cloud services, and internal dashboards. The attacker openly announced the breach in Uber's Slack channels.

What Data Was Exposed

Who Is Affected

While the breach primarily exposed internal corporate data and systems, Uber employees and contractors were directly affected. The exposure of vulnerability reports and internal systems could indirectly put Uber customers at risk. Uber stated no customer data was accessed, though the full scope remains debated.

How to Check If You Were Affected

Uber stated that no customer personal data was accessed during this breach. However, if you are concerned, review your Uber account at auth.uber.com for any unauthorized changes. Check your payment history and connected accounts. Monitor HaveIBeenPwned.com for any future disclosures related to this incident.

What You Should Do Now

• Change your Uber account password
• Enable two-factor authentication on your Uber account
• Review your Uber account for any unauthorized activity or payment changes
• Monitor your linked payment methods for suspicious charges
• Be cautious of phishing attempts referencing Uber

Last updated: February 10, 2026