In September 2022, Uber was breached when a hacker, allegedly an 18-year-old affiliated with the Lapsus$ gang, used social engineering to manipulate a third-party contractor into approving a fraudulent multi-factor authentication (MFA) request. The attacker then escalated privileges using credentials found in plain-text PowerShell scripts, gaining access to Uber's Slack, G-Suite, AWS, and internal finance tools.

Introduction

On 15 September 2022, employees at Uber logged into their internal Slack channel to find a startling message: "I announce I am a hacker and Uber has suffered a data breach."

What followed was one of the most widely analysed cybersecurity incidents of the decade, not because it involved a sophisticated zero-day exploit or state-sponsored tooling, but precisely because it did not. The 2022 Uber breach was a masterclass in social engineering: the art of manipulating human psychology to bypass technical security controls.

For organisations across every industry, the Uber breach is a stark reminder that even a company with a multi-billion-dollar technology infrastructure can be undone by a single contractor approving one too many push notifications.

At Ascella Group, we work with organisations to build security cultures that are resilient not just to technical threats, but to the human ones. This case study breaks down exactly how the Uber breach happened, step by step, and what every organisation must learn from it.

Who Was Behind the Uber Breach?

The attack was attributed to a hacker going by the alias "Tea Pot", reported to be an 18-year-old who claimed affiliation with, or membership of, the Lapsus$ cybercriminal group. Lapsus$ first appeared on the radar of security researchers in mid-2021 and quickly made headlines for targeting some of the world's largest corporations.

By 2022 alone, Lapsus$ had breached Microsoft, Cisco, Samsung, NVIDIA, Okta, T-Mobile, and now Uber, a remarkable run for what cybersecurity researchers described as a loosely organised group of young "hacktivists" motivated more by notoriety than financial gain.

The same attacker also claimed responsibility for breaching video game developer Rockstar Games just days after the Uber incident, leaking early footage of Grand Theft Auto VI, further confirming their appetite for high-profile disruption rather than quiet financial extraction.

Reference: The Hacker News, September 2022, "Uber Blames LAPSUS$ Hacking Group for Recent Security Breach"

How the Uber Breach Happened: Step by Step

Understanding the anatomy of the attack is essential for building defences against it. The breach unfolded in six distinct stages.

Stage 1: Credential Theft via the Dark Web

The attack began not with hacking, but with shopping. The attacker obtained the login credentials of an Uber external contractor, most likely by purchasing them from a dark web marketplace where stolen credential sets are routinely traded. Some reports, including a New York Times account sourced directly from the hacker, suggest the credentials may also have been obtained via smishing (SMS phishing), where the contractor was sent fraudulent text messages impersonating Uber's IT support team.

Either way, the attacker had a valid username and password before any technical attack commenced.

Stage 2: MFA Fatigue, Wearing Down Human Patience

With the credentials in hand, the attacker attempted to log in to Uber's corporate systems. The account was protected by multi-factor authentication (MFA) via push notifications, a method that sends an approval request to the account holder's smartphone.

Rather than abandoning the attempt, the attacker deployed a tactic known as MFA fatigue (also called MFA bombing): flooding the contractor's phone with repeated MFA push approval requests, one after another, over an extended period. The barrage of notifications was deliberately designed to exhaust, confuse, and frustrate the target.

After approximately one hour of relentless push notifications, the contractor had not yet approved any of them.

Stage 3: Social Engineering via WhatsApp Impersonation

At this point, the attacker escalated their social engineering. They contacted the contractor directly via WhatsApp, posing as a member of Uber's internal IT security team. Their message was simple and persuasive: the notifications would only stop once the contractor approved the authentication request.

The contractor, already mentally fatigued from an hour of incessant notifications and now believing they were speaking with a trusted Uber employee, approved the MFA request.

This single approval gave the attacker their foothold inside Uber's corporate environment.

This technique is now recognised as a textbook case of pretexting, a form of social engineering where the attacker constructs a believable false identity and scenario to manipulate their target into an action they would otherwise refuse.

Stage 4: Privilege Escalation, Credentials in Plain Text

Once inside the contractor's account, the attacker did not immediately have the "keys to the kingdom." However, through lateral movement within Uber's internal network, the attacker discovered something alarming: PowerShell scripts stored on internal network shares that contained hardcoded admin credentials in plain text.

These credentials granted the attacker elevated administrative access across a significant portion of Uber's internal infrastructure, an avoidable failure of basic secrets management hygiene.

Stage 5: Lateral Movement and System Compromise

With admin credentials in hand, the attacker pivoted rapidly across Uber's internal systems. According to post-breach analysis by HumanFirewall and confirmed by Uber's own disclosures, the compromised systems included:

• Slack (internal messaging, where the hacker ultimately posted their announcement)

• Google Workspace / G-Suite (admin access to corporate email and documents)

• Amazon Web Services (AWS)

• VMware vSphere (virtualisation platform for cloud and on-premise servers)

• Uber's internal finance tool managing company invoices

• HackerOne, Uber's bug bounty platform, which contained detailed reports of unpatched vulnerabilities

Access to HackerOne was particularly damaging from a security standpoint. The attacker reportedly exfiltrated all open vulnerability reports before losing access, potentially providing a roadmap for future exploitation of unpatched weaknesses.

Stage 6: Public Disclosure, Announcing the Breach from Within

Rather than quietly exfiltrating data for financial gain, the attacker chose a more theatrical approach consistent with Lapsus$ behaviour: posting a message directly to Uber's company-wide Slack channel announcing the breach. They also altered the URL of at least one internal website to display an explicit image to any employee who visited it.

Uber's security team scrambled to contain the damage, disabling affected tools, locking compromised accounts, enforcing mandatory password resets, and shutting down Slack temporarily.

What Data Was Actually Compromised?

Despite the significant depth of access the attacker achieved, Uber maintained that no customer personal data was compromised and that no unauthorised code changes were made to production systems.

What was accessed included:

• Internal Slack messages

• Internal finance tool data (invoices)

• HackerOne bug bounty reports (unpatched vulnerability disclosures)

• Administrative access to Google Workspace, AWS, and VMware vSphere

Cyber researchers noted that the attacker's motivation appeared to be notoriety rather than financial gain, a hallmark of Lapsus$ operations. Had the attacker sold Uber's HackerOne vulnerability reports on a dark web marketplace, the financial and security consequences could have been far more severe.

The Psychology Behind the Attack: Why Social Engineering Works

The Uber breach was not, at its core, a technical failure, it was a human failure enabled by poor security culture and inadequate controls. Understanding why social engineering succeeds is the first step to defending against it.

Cognitive overload and decision fatigue are central to the MFA fatigue technique. After receiving dozens of authentication requests in rapid succession, a person's ability to make careful security decisions degrades. The brain looks for any action that makes the discomfort stop, and approving the request does exactly that.

Authority and impersonation are equally powerful. When someone who claims to be from your company's IT team tells you the notifications will stop if you approve the request, your brain applies the same social compliance mechanisms that govern everyday life. We are wired to trust perceived authority figures.

The Uber breach also exposed a critical gap in third-party and contractor security awareness. The compromised individual was not a full-time Uber employee but an external contractor. Companies often invest heavily in security training for their core workforce while leaving contractors, who may have deep access to internal systems, significantly undertrained.

Key Cybersecurity Lessons from the Uber Breach

1. MFA Is Not a Silver Bullet

Push-based MFA can be defeated through persistence and social engineering. Organisations should implement phishing-resistant MFA such as hardware security keys (FIDO2/WebAuthn) or number-matching MFA prompts, which are far more resistant to fatigue-based attacks.

2. Secrets Must Never Live in Scripts

The plain-text admin credentials found in PowerShell scripts were the key that unlocked Uber's systems. Secrets management platforms, such as HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault, exist precisely to prevent this class of exposure. No credentials should ever be hardcoded in scripts accessible on shared network drives.

3. Third-Party Contractors Are Part of Your Attack Surface

As the Uber breach demonstrated, a compromised contractor account can provide the same access as a compromised full-time employee. Third-party vendor risk management must include robust security awareness training, privileged access management, and regular access reviews. In Uber's case, the compromised vendor was reportedly a Privileged Access Management (PAM) provider called Thycotic, underlining how ironic and devastating vendor compromise can be.

4. Security Awareness Training Must Cover Social Engineering Explicitly

Staff and contractors must be trained specifically to recognise and report unsolicited MFA requests. Any unexpected authentication prompt, especially after receiving a suspicious call or message, should trigger an automatic security report, not compliance.

5. Principle of Least Privilege

Once inside the contractor's account, the attacker was able to escalate to admin-level access across multiple critical systems. Implementing a strict least-privilege access model, where every user and contractor has access only to the specific systems required for their role, would have dramatically limited the blast radius of the initial compromise.

Uber's History with Data Breaches

It is worth noting that 2022 was not Uber's first encounter with a significant data breach. In 2016, Uber suffered an even larger incident in which hackers accessed the personal data of over 57 million users and 600,000 driver licence numbers. Rather than disclosing the breach, Uber reportedly paid the attackers $100,000 to delete the data and maintain silence. The breach was only publicly disclosed in 2017 following a change in leadership.

The 2022 incident, while less damaging in terms of user data exposure, demonstrated that Uber's security culture had room for substantial improvement, particularly around contractor management, secrets handling, and MFA implementation.

Reference: TeamPassword, "The 2022 Uber Breach"

How Organisations Can Protect Themselves

The tactics used in the Uber breach, credential theft, MFA fatigue, social engineering impersonation, and lateral movement through poorly managed secrets, are not unique to Uber. They represent a playbook increasingly used against organisations of all sizes.

Practical defences include:

• Deploying phishing-resistant MFA (hardware tokens, FIDO2)

• Implementing a centralised secrets management system

• Conducting regular purple team exercises simulating social engineering attacks

• Training all staff and contractors on MFA fatigue and pretexting tactics

• Enforcing least-privilege access and just-in-time access provisioning

• Monitoring for anomalous lateral movement with a robust SIEM/SOAR platform

• Establishing a zero-trust network architecture that never implicitly trusts any user or device

FAQ

What is social engineering in cybersecurity? Social engineering is the manipulation of people, rather than systems, to gain unauthorised access to information or infrastructure. It exploits psychological biases such as trust, authority, and urgency rather than technical vulnerabilities.

How did the hacker bypass Uber's MFA in 2022? The hacker used an MFA fatigue attack, flooding the contractor with repeated push notification requests until fatigue set in, then impersonated an Uber IT employee via WhatsApp to convince the contractor to approve one of the requests.

Was customer data stolen in the Uber 2022 breach? Uber confirmed that no customer personal data, from Uber, Uber Eats, Uber Freight, or Uber Driver, was exfiltrated. Internal communications, financial tool data, and HackerOne vulnerability reports were accessed.

Who was responsible for the Uber 2022 hack? Uber attributed the breach to a hacker affiliated with the Lapsus$ group, an 18-year-old known online as "Tea Pot" who also claimed responsibility for the Rockstar Games hack shortly after.

What is MFA fatigue? MFA fatigue (or MFA bombing) is a social engineering technique where an attacker repeatedly sends authentication push notifications to a target's phone, hoping the target will eventually approve one out of frustration or confusion.

What should organisations do to prevent social engineering attacks? Organisations should implement phishing-resistant MFA, provide regular security awareness training focused on social engineering tactics, enforce least-privilege access, manage secrets securely, and establish robust third-party vendor security requirements.

Conclusion

The 2022 Uber breach is a defining case study for the modern cybersecurity landscape. It demonstrates, with uncomfortable clarity, that the human element remains the most exploitable vector in any security architecture. No firewall prevents a tired contractor from approving a push notification. No encryption stops an attacker who already has your admin password, written in plain text in a shared script.

At Ascella Group, we believe that true cyber resilience is built on three pillars: technical controls, sound processes, and, most critically, a security-aware culture that empowers every person in your organisation, from full-time staff to external contractors, to recognise and resist manipulation.