Loading story…
Uber disclosed that an attacker breached its internal environment after socially engineering a contractor and abusing push-based multi-factor authentication. According to Uber and multiple reports, the intruder used stolen credentials to access the company over VPN, then moved through internal resources including Slack, Google Workspace, Windows domain systems, AWS, VMware infrastructure, dashboards, and the company's HackerOne bug bounty account. The attacker reportedly found privileged credentials in internal scripts tied to privileged access management, enabling broader access to secrets and administrative systems.
Uber said core services remained operational and that it found no evidence that sensitive customer data such as trip histories, credit card information, or cloud-stored user records were accessed, though internal Slack messages and finance-related files were downloaded. A particularly serious consequence was the exposure of Uber's private HackerOne submissions, raising the risk that unfixed vulnerabilities were revealed. Uber later said the activity was likely linked to a person associated with LAPSUS$, citing tactics similar to earlier intrusions at major technology firms, and said it was working with the FBI and DOJ while strengthening defenses against MFA fatigue and social-engineering attacks.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Uber said the recent breach was likely carried out by a person associated with the LAPSUS$ hacking group, citing similarities to prior attacks. The company also said it was coordinating with the FBI and the US Department of Justice while continuing its forensic investigation.
Reporting on the breach said the intruder accessed Slack, Windows domain resources, AWS, VMware vSphere/ESXi, Google Workspace administration, and Uber's HackerOne bug bounty environment. The exposure of private HackerOne reports raised concern that unfixed vulnerabilities may have been downloaded.
Uber disclosed a cybersecurity incident after an attacker claimed to have breached the company through social engineering and MFA prompt abuse. The company said it was working with law enforcement, kept core services operating, and stated it had no evidence that sensitive user data such as trip history was accessed.
A cyberattack exposed data belonging to 57 million people connected to Uber. Bloomberg later reported that Uber concealed the incident and paid the hackers to delete the stolen data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
9 references tracked. Mallory keeps watching after this page renders.
pcmag.com
Open sourcetechcrunch.com
Open sourcecybersecuritydive.com
Open sourcetechtarget.com
Open sourcethehackernews.com
Open sourceuber.com
Open sourceblog.gitguardian.com
Open sourcebleepingcomputer.com
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Uber Freight said it is investigating a data security incident involving unauthorized access to parts of its systems and repositories after the **Helix** extortion group listed the company on its leak site and claimed to have posted nearly 1 million files online. Reports said the alleged haul included data from mailboxes, OneDrive accounts, and the accounts receivable department, although Uber Freight did not confirm the authenticity of the leaked material. The company said the intrusion was identified, contained, and remediated, and that business operations were not disrupted. Uber Freight also said it had engaged federal law enforcement as the incident drew links to a wider campaign targeting prominent U.S. companies. Researchers cited in the reports tied Helix to a broader extortion ecosystem associated with **BlackFile** and the **UNC6671** cluster, which has been linked to credential theft through vishing and device-code phishing and to follow-on access into cloud services such as **Microsoft 365** and, in some cases, **Okta** environments.
Aug 13, 2026
Grubhub confirmed that unauthorized actors downloaded data from some of its internal systems and that the company is now facing extortion demands. Grubhub said it investigated and stopped the activity and stated that *sensitive information* such as financial data and order history was not impacted; it also engaged a third-party cybersecurity firm and notified law enforcement. Sources cited in reporting attribute the extortion attempt to **ShinyHunters**, with the threat actors allegedly demanding Bitcoin to prevent publication of data. According to sources, the extortion leverages both older **Salesforce** data tied to a February 2025 incident and newer data allegedly taken from **Zendesk**, which Grubhub uses for customer support chat. Reporting also links the intrusion to follow-on activity stemming from the broader **Salesloft Drift**-related credential/OAuth token theft activity, where compromised tokens for Salesloft’s Salesforce integration were used to harvest credentials and secrets for subsequent attacks against downstream services. Separately, Monroe University disclosed a distinct 2024 network breach affecting ~320,000 individuals; it is unrelated to the Grubhub incident and involves theft of extensive personal, financial, and health data.
Jun 29, 2026
FulcrumSec has claimed responsibility for breaching UK engineering firm Arup Group and stealing large volumes of data, later listing the company on its Tor leak site. According to the threat actor’s account, the intrusion began in September 2025 after attackers found a GitHub personal access token hardcoded in a JavaScript file on a forgotten Arup subdomain, which allegedly opened access to more than 10,000 private repositories and led to additional credentials in code. The group said it exfiltrated about **700GB of GitHub repositories**, **2TB of Azure and AWS S3 data**, database backups, source code, and other internal material before credentials were rotated. The stolen data allegedly included sensitive information tied to major clients and infrastructure projects, including HS2-related repositories, Euston Station design files, archaeological GPS coordinates, Neuron BMS and Odoo ERP data, Apple code-signing certificates with plaintext passwords, and GCP payment gateway credentials. FulcrumSec said Arup detected parts of the intrusion roughly six weeks after initial access but that the attackers retained visibility into the environment for months, analyzing the haul before contacting the company in April 2026. The incident underscores the downstream risk posed by hardcoded secrets, forgotten internet-facing assets, delayed credential rotation, and weak monitoring of source-code and cloud environments.
Jun 29, 2026