September 15, 2022: Uber discloses a breach of its internal systems by an attacker who would turn out to be a teenager affiliated with the Lapsus$ crew — an intrusion executed not with exotic zero-days but with a purchased password and a spam of push notifications. The chain: the attacker obtained a contractor’s Uber password (reportedly bought on the dark web after an infostealer infection), then bombarded the contractor’s device (and, per Uber’s account, a corporate Slack) with MFA push requests until one was approved — the textbook MFA-fatigue (push-bombing) attack. Inside, the attacker roamed Uber’s internal network, found PowerShell scripts containing hardcoded credentials for privileged access to internal administrative tooling and other internal systems (per Uber’s own published incident account and contemporaneous reporting), accessed internal tools including vSphere/ESXi central console and the corporation’s vulnerability scanner, and announced the intrusion inside Uber’s Slack with a message to staff. Despite the dramatic access, Uber’s forensic review found no customer or rider data accessed, no financial information altered; the attacker’s trophies were internal screenshots, source-adjacent material, and the Slack broadcast itself. For defenders, September 2022 delivered the modern intrusion canon in miniature: credentials are for sale, OTP push is phishable and fatigue-able, hardcoded secrets in scripts are persistence gold, and internal networks must be built assuming the adversary is already inside — because for the price of a password listing and some patience, they can be.
The Uber September 2022 breach (disclosed September 15, 2022) was a credential purchase + MFA-fatigue intrusion by a hacker affiliated with the Lapsus$ group (per Uber’s incident statement; the actor was reportedly 18 years old). Kill chain: (1) contractor’s Uber credentials bought on dark web (malware/infostealer origin); (2) MFA-fatigue: dozens of push notifications spammed at the contractor’s device until one was approved (Uber’s account also describes the attacker posing as Uber IT via WhatsApp, telling the contractor a notification was coming and should be approved — social engineering layered on the bombing); (3) internal network access (Uber’s Slack, internal tooling including the vSphere console and vulnerability-scanner surfaces, per reporting); (4) persistence via hardcoded credentials: PowerShell scripts on a network share contained privileged credentials that expanded access to multiple internal systems, including DUeatt (Uber’s internal administrative tooling, per the company’s published account); (5) Slack broadcast announcing the breach to employees with a hashtag-flip gesture; (6) containment: Uber took affected systems offline, rotated credentials, and narrowed MFA policies. Impact per Uber’s review: internal screenshots and source-adjacent material exposed; no customer data accessed, no financial information modified, and the threat actor accessed the company’s vulnerability scanner data and an internal Slack workspace. Root causes: password market (infostealer economy), push-approval UX designed for convenience over security, hardcoded production credentials in scripts, flat internal network trust, and the absence of phishing-resistant MFA. 2026 lens: every link in this chain now has a named control: passkeys/FIDO2 kill credential replay, number-matching kills fatigue-approval (or mitigates), secret-scanning kills hardcoded creds, and zero-trust segmentation contains roaming. Uber’s case was the moment those controls moved from best-practice lists to board-level mandates, because it dramatized that a teenager with a stolen password could reach the vSphere console of a Fortune-scale company.
What happened
The intrusion began with the least glamorous step possible: buying a password. The contractor’s Uber credentials were available on criminal markets — the standard downstream effect of an infostealer infection on some past device — and the attacker simply acquired them. What stood between the password and Uber’s interior was MFA: push notifications asking “Was this you?” The attacker’s answer was volume and social proof: dozens of pushes, then (per Uber’s account) a WhatsApp message posing as Uber IT warning that the notifications were coming and should be approved to make them stop. One approval later, the attacker held a live session.
Inside, the deep-dive found a network share with PowerShell scripts — internal automation — containing hardcoded credentials for privileged access to internal systems. Those scripts were persistence and movement in one: the attacker used them to reach internal administrative tooling, accessed the corporate vulnerability scanner, and reached the vSphere central console (per Uber’s published account and contemporaneous reporting). The attacker crossed into public view by posting in an Uber internal Slack channel (allegedly announcing the breach to employees); Uber’s security teams took affected systems offline, rotated credentials, and reinforced MFA policy within hours.
The forensics were the anticlimax and the relief: no customer or rider data accessed, no financial information altered, and the attacker’s visible goals looked more reputational/trophy-seeking than mercantile — in line with the Lapsus$ crew’s notoriety-oriented operations against Microsoft, Okta, NVIDIA, and Rockstar in the same era. The breach’s real damage was the lesson-bomb: screenshots of internal consoles circling publicly, a Slack full of employees watching the intrusion live, and a CISO now fielding “so a teenager bought a password and reached vSphere?” from the board.
The kill chain, in one diagram
Uber September 2022 kill chain:
STEP 1 - CREDENTIAL ACQUISITION
contractor's Uber password
bought on dark web
(infostealer-harvested,
resale market)
STEP 2 - MFA FATIGUE / PUSH BOMB
dozens of push requests
to contractor's device
+ WhatsApp social eng:
"IT here, approve the
notification to stop
them"
-> one approval = live
authenticated session
STEP 3 - INTERNAL ROAMING
Slack, internal tools
network shares
STEP 4 - HARDCODED CREDS
PowerShell scripts on
share contain priv
credentials
-> internal admin tooling
-> vulnerability scanner
-> vSphere central console
(per Uber's account)Impact and numbers
| Metric | Value |
|---|---|
| Disclosure | September 15, 2022 |
| Actor | Hacker affiliated with Lapsus$ (reportedly 18 years old) |
| Initial access | Purchased contractor credentials + MFA-fatigue push approval |
| Privilege expansion | Hardcoded credentials in PowerShell scripts (network share) |
| Systems reached | Slack, internal admin tooling, vulnerability scanner, vSphere console |
| Customer data | None accessed (per Uber's forensic review) |
| Financial data | None modified (per Uber's review) |
A patience chain: how a patient adversary advances step by step
Uber's September intrusion is best read not as one event but as a patience chain — each step rehearsed, cheap, and dependent on the previous one. It's the same shape as the corporate world's other 2022 patience chains: buy or steal credentials, overwhelm or social-engineer the second factor, roam until a hardcoded secret unlocks privilege, then monetise notoriety. The defences that answer it are equally stepwise: make replay impossible (phishing-resistant factors), make fatigue harder (number matching, rate limits), make roaming expensive (segmentation, least privilege), and make stored secrets scarce (secret scanning, vaults). Security teams that map their controls against this chain find their gaps quickly — the exercise takes an afternoon and pays for a decade.
Who was Lapsus$ and why did teens keep breaching giants?
Lapsus$ was a crew — largely teenagers, per law-enforcement charges and reporting from the era — that breached Microsoft, Okta, and NVIDIA, Rockstar Games, and others in 2022 with a consistent formula: buy or socially engineer credentials, bypass MFA with fatigue or relay techniques, and steal data for notoriety. Their targets were chosen for trophy value; their techniques were unsophisticated but executed with patience and target discipline. The Uber intrusion bore the crew's signatures (Slack broadcast, trophy screenshots), and the era's wider lesson was that initial-access economics (password markets, helpdesk social engineering) had matured enough that age and budget were no longer prerequisites for reaching the core of a Fortune-scale network.
Why it still matters in 2026
Because every element of the Uber chain has since become a named control category, and every one of those controls remains unevenly deployed. Credential markets have only grown (infostealer logs now fuel AI-assisted targeting), push-fatigue remains viable wherever number-matching hasn't shipped, hardcoded secrets still surface weekly in secret-scanner reports, and internal flat networks still let one session reach vSphere. The 2026 stack that answers this chain is standard on paper — phishing-resistant MFA, number-matching as interim, secret-scanning in CI and on shares, JIT privilege, and segmentation that treats every identity as potentially adversary-controlled — but the Uber case is the reminder that the adversary's chain is only as strong as its weakest link, and yours is only as strong as your laziest script on a share full of embedded passwords. The case also previewed the AI-era intensification: social-engineering pre-texts are now drafted and personalised at machine speed, making the WhatsApp-posing-as-IT step cheaper and more convincing. Uber's September 2022 was a dress rehearsal the industry watched live on Slack — and the fact that a rehearsed teenager could reach a vulnerability scanner and a vSphere console with a bought password is why those controls are now procurement line-items rather than suggestions.
Detection and hardening takeaways
- Deploy phishing-resistant MFA on every human access path. FIDO2 keys and passkeys cryptographically bind sign-in to the true origin and cannot be fatigue-approved — the Uber chain dies at step two if the factor isn't push-based. Number-matching and push rate-limits are the interim mitigation that raises fatigue cost while the key-bound migration completes.
- Hunt hardcoded secrets like production incidents. The privilege expansion lived in PowerShell scripts on a share. Secret-scanning must cover not just repositories but network shares, wiki pages, ticketing systems, and script libraries — with automated revocation of anything found, because a secret exposed on a share must be assumed sold. Canary credentials in likely spots turn discovery into detection.
- Segment as if the session is already hostile. One approved push became network-wide roaming. Zero-trust segmentation (per-application access, device-posture gating, JIT elevation for admin consoles like vSphere) converts a foothold into a contained incident. Consoles that manage infrastructure are crown jewels — they demand step-up auth and dedicated bastions, not domain trust.
- Instrument the MFA layer for abuse patterns. Repeated push denials followed by approval, approval within seconds of a burst, approvals from new-AS N geographies, and push volume per account in a short window are all pre-compromise signals. Alert on them, and auto-enroll fatigued accounts into step-up verification — the fatigue pattern is the attack, visible before the compromise.
- Prepare the internal-broadcast scenario. The attacker announced themselves in Slack. Have the IR plan cover internal comms takeover: pre-built employee guidance for "someone is posting as an intruder in Slack," channels restricted to verified staff during incidents, and comms templates that inform without amplifying. Employees watching a live breach narration need direction, not silence.
FAQ
Did the Uber hacker use a zero-day?
No. The chain ran on a purchased password, push-notification spam plus a WhatsApp social-engineering assist, and hardcoded credentials in internal scripts. That ordinariness is the case's core lesson: initial access to a Fortune-scale interior no longer requires exotic exploit capability — market-bought credentials and patience suffice.
What internal systems were named in Uber's account?
Uber's published incident account described the attacker reaching internal administrative tooling, the corporate vulnerability scanner, and the vSphere central console, with the pivotal discovery being PowerShell scripts on a network share holding hardcoded privileged credentials. The exact tool names matter less than the pattern — admin consoles behind flat trust — which is universal.
Was customer data stolen in the Uber 2022 breach?
Per Uber's forensic review: no customer or rider data was accessed, no financial information was altered. The exposure was internal — screenshots of consoles, source-adjacent material, and the Slack broadcast. The reputational dimension (employees and public watching live) exceeded the data dimension.
Why did the attacker announce the breach in Slack?
Trophy dynamics. The Lapsus$-affiliated crews of 2022 operated for notoriety as much as profit: public broadcasts maximize attention, prove access to peers, and complicate containment. The behaviour signals that not every intrusion is mercantile — and that IR plans need a comms dimension, not just a technical one.
