The ride-hailing and food delivery company, Uber was hacked. The company on Thursday evening informed that it was responding to “a cybersecurity incident” and was contacting law enforcement about the breach. The data breach incident had taken many of Uber’s internal systems offline, The New York Times reported.
Uber is claiming that sensitive user data wasn’t compromised. “Internal software tools that we took down as a precaution yesterday are coming back online”, Uber said in a statement posted online. The company denied that critical user data including trip histories had been accessed by the hacker, however, avoided responding to The Associated Press regarding whether the data was encrypted or not. Security experts claim that the harm of the hack was substantial and that the screenshots taken by the hacker and leaked online, show the company’s complete access to the cloud-based infrastructure that Uber uses to hold private consumer and financial data.
The cyber attack has been allegedly made by an 18-year-old hacker who bragged to multiple security researchers about the steps they took to breach the company. The hacker told the New York Times that he deployed social engineering techniques targeting an Uber employee by simply posing as a member of the corporate IT team in an SMS. He was able to convince the employee to send over a password that gave him access and what followed is a sequence of events that led to a large-scale compromise of the ridesharing company’s IT systems.
The screenshots of the conversation with the hacker have been leaked online, giving a glimpse of how the attack unfolded. The teen hacker announced himself on the company’s Slack channel saying, “I announce i am a hacker and uber has suffered a data breach.” The message ended by calling out Uber for underpaying its drivers.
Initially, the employees at the company did not think Uber was hacked, instead thought the whole thing was a joke. A staff engineer at Yuga Labs, the company behind the Bored Ape Yacht Club NFT project, Sam Curry shared additional information about the hack on Twitter that he says he received from a contact at Uber. The tweet says that Uber’s domain admin, Amazon Web Services admin and GSuite were among some of the company accounts that were compromised. After the hacker announced Uber was hacked, the company quickly warned its employees to stay away from Slack, but according to Curry’s contact, many people in the company kept logging back on to check out everyone’s joke responses.
From another Uber employee:
Instead of doing anything, a good portion of the staff was interacting and mocking the hacker thinking someone was playing a joke. After being told to stop going on slack, people kept going on for the jokes. lmao
— Sam Curry (@samwcyo) September 16, 2022
Now, after Uber was hacked last week, reports have come that the same hacker is behind hacking Rockstar Games as well. Videos of Grand Theft Auto (GTA) 6, which is still in the early stages of development, have been leaked and published online and the hacker, using a handle of teapotuberhacker and posting to the GTAForums fan forum, claims to be the same ‘Tea Pot’ hacker who was behind the Uber incident.
