The breach was first announced by what seemed to be a lone hacker who apparently tricked an Uber employee into handing over their credentials. As the Associated Press reports, the company said its services, temporarily taken down as a precautionary measure, were operational again. Uber said there was no sign the hacker had accessed ride histories or other “sensitive user data.”
It wasn’t immediately clear how long the hacker was inside Uber’s systems or how much data they took. The hacker self-identified as an 18-year-old to one security researcher who communicated with them. The researchers said the hacker seemed to be motivated by publicity. (As CNN reports, Uber has since claimed that the hacking group Lapsus$ was responsible for the attack.)
The potential damage was significant: The person shared screenshots with researchers showing access to the cloud-based systems where Uber stores sensitive customer and financial data.
As Claims Journal reports, the breach puts focus on a form of social engineering that is becoming more and more widespread, where hackers pose as colleagues and fool employees into giving them access.
Similar social engineering was used in a 2020 cybersecurity incident at Twitter and more recent hacks of tech companies Twilio and Cloudflare. Rachel Tobac, CEO of SocialProof Security, which offers training against social engineering, told Claims Journal that “even super smart tech savvy people fall for social engineering methods every day.”
As hackers increasingly work around multi-factor authentication, many security pros have called for the use of what are known as Fido physical security keys for user authentication.
As The Wall Street Journal reports, the Uber breach highlights how top tech companies are still vulnerable to breaches. Digital identity verification provider Okta and security-focused messaging service Signal have each also disclosed security breaches this year, with Signal blaming third-party vendor Twilio.
As ITP.net reports, the Uber breach spurred calls among the cybersecurity community for companies to “get the basics right.”
According to Ars Technica, this kind of breach will persist until FIDO2 forms of MFA requiring a phone or physical key become more widespread.