According to a New York Times (NYT) report, American ride-hailing company, Uber has been hacked. The report said that Uber has suffered a system breach as employees were unable to access internal tools such as Slack. After the incident, Uber is investigating a cybersecurity issue and for safety concerns have taken various internal systems, including Slack, offline.
We are currently responding to a cybersecurity incident. We are in touch with law enforcement and will post additional updates here as they become available.
— Uber Comms (@Uber_Comms) September 16, 2022
“We are currently responding to a cybersecurity incident. We are in touch with law enforcement and will post additional updates here as they become available.” Uber wrote on Twitter.
The hacker appears to have made themselves known to Uber’s employees by posting a message on the company’s internal Slack system. “I announce I am a hacker and Uber has suffered a data breach,” screenshots of the message circulating on Twitter read. The claimed hacker then listed confidential company information they said they’d accessed, and posted a hashtag saying that Uber underpays its drivers.
According to the Washington Post, many Uber employees first appeared to have thought the alleged hacker’s Slack post was a prank due to its bold nature.
The hacker claimed to the NYT to be 18 years old, and told that they breached Uber for fun and might leak the company’s source code. In a conversation with cybersecurity researcher Corben Leo, they also claimed to have gained access to Uber’s systems through login credentials obtained from an employee via social engineering, which allowed them to access an internal company VPN. From there, they found PowerShell scripts on Uber’s intranet containing access management credentials that allowed them to allegedly breach Uber’s AWS and G Suite accounts.
