NewsCompaniesFlawsGuides
Get the app

The Uber hack: how a contractor’s accepted MFA prompt let an attacker in

From the HARD Journal · · 6 min read
This article is about the September 2022 attack on Uber. For the separate case against Uber’s former security chief, see Who was said to be behind it.

A contractor's stolen password, a stream of approval prompts, and one tap on Approve. What Uber said happened in September 2022, who was said to be behind it, and what to do about MFA fatigue.

The Uber hack of September 2022 started with a contractor's stolen password and a phone that wouldn't stop buzzing. Uber says the contractor received repeated two-factor approval prompts, accepted one, and the attacker logged in. From there the attacker reached Uber's Slack, Google Workspace and internal tools, and announced it to the whole company.

Uber says it found no evidence the attacker reached sensitive customer data, and that is why this one is worth reading closely. Repeated approval prompts can pressure someone into accepting an attacker's login.

What happened, and when

WhenWhat happened
Before 15 September 2022Uber says a contractor's personal device was infected with malware, which exposed the contractor's corporate login details. Uber says it is likely the attacker bought that password on the dark web.[1]
15 September 2022The attacker repeatedly tries to log in with the contractor's credentials, and each attempt sends the contractor a two-factor approval request. The contractor eventually accepts one. Uber posts its first notice that evening, US Pacific time.
Inside the networkUber says the attacker gained elevated permissions on other employee accounts, which gave access to several internal systems including G Suite (Google Workspace) and Slack. The attacker posted a message to a company-wide Slack channel and changed Uber's OpenDNS settings so that some internal sites showed a graphic image.
16 SeptemberUber says its public services are operational and that it has found no evidence of access to sensitive user data.
19 SeptemberUber publishes a fuller report and says it believes the attacker is affiliated with a hacking group called Lapsus$.[1]
23 August 2023A London jury finds that Arion Kurtaj, who was 18 and was claimed in court to be a key member of Lapsus$, carried out the acts he was charged with. Reports of the case list Uber among the attacks. He had been assessed as unfit to stand trial, so the jury was asked whether he did the acts, not whether he intended a crime.[2]

How the attacker got in: MFA fatigue

Multi-factor authentication adds a second check after the password. Many companies make that second check a push notification: your phone shows "Approve sign-in?" and you tap yes. It is much safer than a password alone. But it has a weakness. If an attacker already has the password, they can trigger the prompt again and again, at any hour. Some people approve just to make it stop. Others assume a colleague or the IT team is testing something. This is called MFA fatigue, or a push bombing attack.

Uber's own account is short. The attacker kept trying to log in, each attempt sent the contractor an approval request, and the contractor eventually accepted one.[1]

Repeated prompts can lead someone to approve a login they did not start.

What the attacker reached, and what Uber says wasn't taken

Uber said it appeared the attacker downloaded some internal Slack messages and information from a finance team invoicing tool, and that the attacker could access its HackerOne dashboard, where security vulnerability reports are submitted. It said it had no evidence of access to sensitive user data such as trip history, and had not seen the attacker make any code changes. Uber's response included blocking or resetting compromised accounts, rotating keys, locking down its codebase, requiring re-authentication and strengthening its multi-factor authentication policies.[1]

That is Uber's account, written within days of the event. Investigations can change. Treat "no evidence" as what it is: a statement about what had been found at the time.

Who was said to be behind it

Uber said it believed the attacker was affiliated with Lapsus$. In a London court, prosecutors said Arion Kurtaj targeted Revolut and Uber in September 2022 and then Rockstar Games, the maker of Grand Theft Auto. Reports of the prosecution's account put the damage to Uber at nearly US$3 million.[3] The jury's finding came on 23 August 2023.

Don't confuse this with a separate Uber case. Uber's former security chief, Joe Sullivan, was found guilty in October 2022 of obstructing a Federal Trade Commission proceeding and of misprision of a felony, over earlier breaches the company did not disclose, including one in 2016.[4] They share a company name and little else.

What it means for a household or an executive

  1. Your phone is the second lock, and it can be leaned on. If your email, bank or password manager approves logins with a tap, a stolen password plus persistence is enough. The same weakness sits in a family office, where one assistant may approve prompts for several people.
  2. The weak point was a contractor. People outside the main payroll, such as advisers, assistants and contractors, often hold real access on devices nobody manages. Their personal phone or laptop is part of your security.
  3. An unexpected prompt is information. A request you didn't start can mean someone is trying to sign in, possibly with your password. Deny it and check the account.

What to do today

  1. Never approve a sign-in you didn't start. Deny it, review the account's recent activity, and change its password from a device you trust if you suspect it has leaked. Treat a stream of prompts as a sign someone is trying to get in.
  2. Move your most important accounts to passkeys or a hardware security key. Start with email, your password manager and your bank. These use cryptographic credentials tied to the service, so approving an attacker's remote login requires more than accepting a push notification. Where you can't, choose an authenticator that makes you type a number shown on the login screen. A plain "Approve" button is the weakest option.
  3. Turn on prompt limits where they exist. Some services let you require a number match or lock the account after repeated denied prompts. If your company runs the login system, ask for that setting.
  4. Use a different password everywhere. The attacker started with a password. A password manager and unique passwords mean one leak doesn't reach the others. The 23andMe breach is the same lesson from the other side.
  5. Check the devices your contractors and staff use. Ask whether anyone with access to your email or shared files signs in from a personal phone or laptop that nobody updates. Remove the access of anyone who has stopped working for you.
  6. Tell the people around you. Give assistants and household staff the same rule: if a prompt arrives that you didn't start, deny it and call the person it would unlock.

Or have someone check this for you. Reviewing how each person in a household signs in, and which of those sign-ins can be tapped through, is the sort of quiet work private cybersecurity is for. For news as it lands, see HARD's alerts. Other breaches we have explained: AT&T and National Public Data.

See also

References

  1. ^ Uber. “Security update”, Sep 2022.Uber's own account: the contractor's account, the accepted two-factor prompt, the systems reached, what it found no evidence of, and its response.
  2. ^ iTWire. “London court finds two teens guilty of Lapsus$ attacks”, Aug 2023.The 23 August 2023 verdict, and the jury's task of deciding whether Arion Kurtaj did the acts.
  3. ^ Sowetan. “Teenager hacked Uber and Grand Theft Auto maker, London court hears”, Jul 2023.What prosecutors told the court about the Uber, Revolut and Rockstar attacks and the damage to Uber.
  4. ^ Farella Braun + Martel. “Uber's former chief security officer found guilty of obstruction”, Oct 2022.The separate case against Joe Sullivan over Uber's earlier breaches.

Sources checked 24 October 2026.