The current era: social engineering teenage crews beating billion-dollar defenses, extortion without encryption, a single company's collapse freezing America's pharmacies — and the closest the internet has ever come to a supply-chain catastrophe.
A London jury convicted the teenage LAPSUS$ hackers whose SIM swaps, MFA-fatigue pushes, and helpdesk manipulation breached Nvidia, Microsoft, Okta, Uber, and Rockstar — closing the criminal case that proved identity is the real perimeter.
A Lapsus$-linked teenager allegedly reached Rockstar's Slack via helpdesk social engineering and posted 90+ GTA VI dev clips. The collaboration suite was the vault.
An 18-year-old bought a contractor's Uber password, bombarded them with MFA pushes until one was approved, then roamed to vSphere via hardcoded credentials.
37GB claimed, one account compromised, no customer data lost — and a DEV-0536 profile that taught the industry how social engineering beats MFA.
One contractor's stolen credentials reached super-admin support tooling across 366 Okta tenants. The identity supply chain's hardest lesson.
One contractor's credentials, 190 GB of Galaxy bootloader and biometrics code, and the pure steal-and-dump model that outlived encryption ransomware.
No zero-days, no malware — just MFA fatigue, SIM swaps, and help-desk social engineering. How Lapsus$ broke every assumption.