Cab service Uber has reportedly suffered from a major cybersecurity attack, compromising several internal communications systems and engineering systems, and taking them offline. The company has confirmed the breach in a tweet.
Uber didn’t reveal the details about the incident or whether any user data was compromised but confirmed that the cyber-criminal was able to post on the company’s Slack after compromising a worker’s account. The hacker is believed to have social-engineered the worker to get hold of password details by masquerading as a corporate IT person and then using it to get access to internal systems and posting an explicit photo on an internal page with a message that the company had suffered a major data breach.
UPDATE: More Uber information data disclosed: vSphere, Google workplace data, and more AWS data. pic.twitter.com/aTSBBuyust
— vx-underground (@vxunderground) September 16, 2022
The hacker also claims to have compromised Uber"s system by posting images of their AWS instance, vSphere, Google Workplace data, and more.
To prevent any further damage, Uber instructed its staff not to use Slack. Other internal systems, too, were made inaccessible to them. The company said that it was investigating a "cybersecurity incident" after a hacker shared evidence that they had breached its computer systems with journalists and security researchers.
The officials from the Uber Comms Twitter handle tweeted:
We are currently responding to a cybersecurity incident. We are in touch with law enforcement and will post additional updates here as they become available.
This is not the ride-hailing company’s first breach. It suffered from a similar attack in 2016. The breach then affected 57 million riders and drivers. It came under scrutiny for failing to fully disclose the incident and paying off the hackers $100,000 to hide the event. It only became publicly known in late 2017.
Update: It appears things are going from bad to worse for Uber. We have now learned that the hacker has disclosed Uber"s financial data. Even after reporting the incident many hours ago, Uber has not provided any information about its findings.
Source: New York Times, UberComms | Image: Uber Newsroom, VX-underground