Summary
In September 2022, an 18-year-old broke into Uber and posted screenshots of its internal systems to prove it, an embarrassingly total compromise that started with a tactic anyone can fall for: pestering. The attacker, part of the Lapsus$ group, had a contractor's stolen password, and to get past multi-factor authentication, simply spammed the contractor with login-approval prompts until, worn down and then nudged over WhatsApp by the attacker posing as IT, they tapped "approve." Once inside, the attacker found a script with a hardcoded admin password that unlocked Uber's most powerful systems at once. It is the textbook lesson in MFA fatigue, and in how one hardcoded secret turns a foothold into a takeover.
How it happened
The attacker started with an Uber contractor's corporate password, bought on the dark web after malware on the contractor's personal device had harvested it. The password alone was not enough, because the account had multi-factor authentication. So they used MFA fatigue: flooding the contractor with repeated Duo 2FA push prompts for over an hour, then socially engineering them over WhatsApp while posing as Uber IT, until the worn-down contractor approved one of the prompts to make them stop.
That single approval put the attacker on Uber's VPN. From there they scanned an internal network share and found a PowerShell script containing hardcoded admin credentials for Uber's privileged-access manager, the very system that is supposed to vault all the other secrets. That one hardcoded password was a skeleton key: it gave them access to AWS, Google Cloud, Google Workspace, Slack, the SentinelOne security console, internal dashboards, the VMware vSphere estate, and the HackerOne bug-bounty admin, all at once.
The damage
The attacker downloaded some internal Slack messages and data from a finance invoicing tool, and posted screenshots widely to prove the scope of the access, even reconfiguring Uber's OpenDNS to show employees a graphic image and announcing the breach in Uber's own Slack ("I announce I am a hacker and Uber has suffered a data breach"), which staff at first took for a joke. Uber stated that its production systems, user accounts, and sensitive user data (trip history, card and bank numbers) were not reached, and that the bug-bounty reports the attacker could read were remediated. The intruder, who used the handle "Tea Pot," was later identified as Lapsus$ member Arion Kurtaj, who was also behind the Revolut and Rockstar Games (GTA VI) intrusions. Kurtaj, who has severe autism, was found unfit to stand trial; a jury found he had committed the acts, and in December 2023 he was sentenced to indefinite detention in a secure hospital.
Why Uber 2022 still matters
It is the definitive MFA fatigue case, paired with a hardcoded-secret disaster. Push-based MFA can be worn down by sheer persistence and a friendly-sounding "IT" message, which is why phishing-resistant FIDO2 or passkey MFA, and at minimum number-matching and a cap on repeated prompts, matter so much. And one hardcoded credential in a script turned a single VPN foothold into control of every cloud and SaaS admin plane, which is why secrets belong in a vault with short-lived, least-privilege, audited checkout, and why the privileged-access manager itself must be the most protected system you run. The cultural fix is just as important: "deny and report" should be the reflex, because real IT never asks you to approve an unexpected prompt. It used the same social-engineering-of-a-human pattern as the MGM and Caesars attack.
How to fix it
- Immediately reset passwords and revoke active sessions and tokens for the compromised identity and every account it could reach.
- Rotate every secret the privileged-access/PAM account exposed (cloud keys, service-account credentials, API tokens, signing keys) and treat them all as burned.
- Pull hardcoded credentials out of every script, repository, and file share, and move them into a vault with short-lived, least-privilege, audited checkout.
- Rebuild the blast radius from SSO, PAM-checkout, and cloud audit logs, and rotate the bug-bounty-platform and EDR-console access the attacker touched.
- Re-enrol affected users on phishing-resistant MFA and add monitoring for anomalous logins and secret access before bringing accounts back online.
How to avoid it
- Use phishing-resistant, hardware-backed MFA (FIDO2/WebAuthn passkeys) for staff and contractors; enable number-matching and cap repeated push prompts so MFA fatigue and push-bombing cannot grind a user into approving.
- Never store credentials in scripts, repositories, or shares: one hardcoded PAM admin credential turned a single VPN foothold into full control of AWS, GCP, Google Workspace, Slack, and HackerOne.
- Protect the privileged-access manager itself with its own MFA, just-in-time elevation, least privilege, and alerting on bulk or unusual secret checkout, so it is not a single point of total compromise.
- Treat contractors and third parties as high-risk identities (device-posture and conditional-access checks, tight scoping, network segmentation), because their personal-device malware becomes your dark-web credential.
- Make "deny and report" the reflex: real IT never asks you to approve an unexpected MFA prompt, and any out-of-band approval request over WhatsApp, SMS, or a call is the attack, not the helpdesk.
- Alert on impossible-travel and new-device SSO logins, and on a single identity suddenly reaching many cloud and SaaS admin planes at once.
References
- https://www.uber.com/newsroom/security-update/
- https://www.bleepingcomputer.com/news/security/uber-links-breach-to-lapsus-group-blames-contractor-for-hack/
- https://www.bankinfosecurity.com/teen-uber-hacker-sent-to-indefinite-hospital-detention-a-23962
- https://therecord.media/british-prosecutors-accuse-teen-lapsus-member-of-uber-revolut-rockstar-hacks
Related vulnerabilities
All OpSec →- CRITICALOPSEC-SNOWFLAKE-2024
In mid-2024, a single gap, accounts without multi-factor authentication, turned into one of the largest waves of data theft ever, hitting Ticketmaster, AT&T, Santander, and around 165 other companies at once. The attackers never broke Snowflake, the cloud data platform all of them used. They simply logged in with valid usernames and passwords, harvested months or years earlier by infostealer malware from employees' personal computers and bought on criminal markets. Where MFA was not turned on, a stolen password was a full key. It is the defining lesson of the infostealer era: your breach can start on an employee's home laptop, and MFA is the difference between a leaked password and a catastrophe.
- CRITICALOPSEC-MIDNIGHT-BLIZZARD-2024
In January 2024, Microsoft revealed that Russia's foreign-intelligence service, the same APT29 behind SolarWinds, had been reading the email of its senior leadership. The way in was almost insulting in its simplicity: a forgotten, non-production test account with a weak password and no MFA. The attackers guessed the password by spraying common ones across many accounts, then pivoted through a forgotten over-privileged application to grant themselves access to corporate mailboxes, including those of executives and the security and legal teams. It is the lesson that your security is only as strong as the account you forgot about, and that even Microsoft's perimeter fell to a missing MFA checkbox.
- HIGHOPSEC-INTERNET-ARCHIVE-2024
The Internet Archive, the nonprofit behind the Wayback Machine, had a brutal October 2024: a data breach, a website defacement, and a wave of DDoS attacks, all at once. Underneath the chaos was an unglamorous root cause. An authentication token sat in plain text in a public config file; the team rotated it repeatedly, but each new token landed right back in the same exposed file, so the leak never actually closed. With it, an attacker downloaded the source code, found more credentials hardcoded inside, and walked out with a database of 31 million users. Weeks later a second token from that same stolen code, for the support system, exposed 800,000 support tickets, some with people's ID documents. It is the lesson that rotating a secret is useless if it goes straight back into a public file, and that one leak unravels everything.
- HIGHOPSEC-MERCEDES-BENZ-2024
Publicly disclosed January 30, 2024, a Mercedes-Benz employee accidentally committed a GitHub authentication token to a public repository, leaving it exposed from September 29, 2023. RedHunt Labs found the token during an internet-wide scan; it granted unrestricted, unmonitored access to Mercedes-Benz's internal GitHub Enterprise Server, allowing anyone to download private source-code repositories that could contain API keys, cloud access keys, database connection strings, blueprints, and SSO passwords. After notification, the token was revoked on January 24, 2024. Mercedes-Benz stated customer data was not affected but could not confirm whether anyone besides the researchers accessed the repositories during the exposure window.
- CRITICALOPSEC-23ANDME-2023
23andMe held the most personal data there is: people's DNA. In 2023 attackers got into more than 18,000 accounts and, through a single social feature, turned that into the genetic and ancestry data of roughly 6.9 million people. The break-in required no flaw in 23andMe at all. Attackers simply took username-and-password pairs leaked from other companies' breaches and tried them, betting, correctly, that people reuse passwords. The accounts had no MFA, and 23andMe did not notice the five-month wave of automated logins. From those footholds, the attackers scraped relatives' data through an opt-in feature, and the fallout, fines, a $50 million settlement, and ultimately bankruptcy and a fire-sale of the DNA database itself, shows that a breach can be fatal even when your own systems were never hacked.
- CRITICALOPSEC-MGM-CAESARS-2023
In September 2023, two of the biggest names in Las Vegas, MGM Resorts and Caesars Entertainment, were brought to their knees, not by a sophisticated exploit, but by a phone call. The Scattered Spider group simply called the companies' IT help desks, impersonated employees, and talked the support staff into resetting their multi-factor authentication, handing the attackers a way in. From there they deployed ALPHV/BlackCat ransomware. Caesars paid about $15 million; MGM refused and took a roughly $100 million hit as slot machines, hotel keys, and check-in systems went dark for days. It is the lesson that the help desk is part of your attack surface, and that the most advanced MFA is undone by a human who can be convinced to reset it.