Uber is investigating a ‘cybersecurity incident’ after hacker claims to access internal systems
It appears Uber has been hacked by an 18-year-old. As discovered Thursday, the hijacker managed to gain full admin access to the company’s AWS, Duo, OneLogin, G Suite, VMware vSphere domain accounts, and more. They even bagged Uber’s source code and have sent out screenshots to prove it.
We are currently responding to a cybersecurity incident. We are in touch with law enforcement and will post additional updates here as they become available.
— Uber Comms (@Uber_Comms) September 16, 2022
Not a great time for Uber then. But what really gets me is how people are meant to have reacted when asked to stop interacting with the hacker on Slack—if you work in IT you might need to ask a friend to hold you back for this one.
According to The New York Times(opens in new tab), the person responsible for the Uber hack claims to have gained access simply by sending a text to an Uber employee pretending to be from the company’s corporate IT team. The hacker, if we can even call them that, just persuaded the employee to send them their login credentials and, boom, full access was granted.
“We are currently responding to a cybersecurity incident,” Uber’s communications team said in a tweet Thursday evening. “We are in touch with law enforcement and will post additional updates here as they become available.”
Uber said in an update Friday afternoon that there was “no evidence that the incident involved access to sensitive user data” such as passengers’ ride history.
Uber said Thursday that it was investigating a “cybersecurity incident” after a hacker shared evidence that they had breached the ride-hailing giant’s computer systems with journalists and security researchers.
The New York Times was the first to report the incident.
Uber said in an update Friday afternoon that there was “no evidence that the incident involved access to sensitive user data” such as passengers’ ride history.
“Internal software tools that we took down as a precaution yesterday are coming back online this morning,” Uber said Friday. “All of our services including Uber, Uber Eats, Uber Freight, and the Uber Driver app are operational.”
Andrew Hasbun, an Uber spokesperson, declined to comment further on the incident.
It’s not the first time Uber has dealt with a security breach. Hackers stole data on 57 million driver and rider accounts in 2016, and Uber paid to cover up the breach.
Uber allegedly paid the hackers $100,000 to get rid of the data. The company 2018 agreed to pay $148 million in a settlement related to the incident with attorneys general from 50 states and DC
Bottom Line.
Please don’t give your passwords out, even if someone claims to be from IT. That team should already have access to your account in case you forget your password.
