Uber Breach Exposed Internal Systems and Private HackerOne Reports

Uber disclosed that an attacker breached its internal environment after socially engineering a contractor and abusing push-based multi-factor authentication. According to Uber and multiple reports, the intruder used stolen credentials to access the company over VPN, then moved through internal resources including Slack, Google Workspace, Windows domain systems, AWS, VMware infrastructure, dashboards, and the company's HackerOne bug bounty account. The attacker reportedly found privileged credentials in internal scripts tied to privileged access management, enabling broader access to secrets and administrative systems.

Uber said core services remained operational and that it found no evidence that sensitive customer data such as trip histories, credit card information, or cloud-stored user records were accessed, though internal Slack messages and finance-related files were downloaded. A particularly serious consequence was the exposure of Uber's private HackerOne submissions, raising the risk that unfixed vulnerabilities were revealed. Uber later said the activity was likely linked to a person associated with LAPSUS$, citing tactics similar to earlier intrusions at major technology firms, and said it was working with the FBI and DOJ while strengthening defenses against MFA fatigue and social-engineering attacks.