Uber 2022 Breach: MFA Push-Bombing and IT-Support Impersonation of a Contractor

What happened

On September 15, 2022, an attacker gained access to Uber's internal systems and announced the intrusion by posting to a company-wide Slack channel and reconfiguring Uber's OpenDNS to show a graphic image on some internal sites. BleepingComputer, working from screenshots of the Slack channel, reported that the announcement was first met with memes and jokes because employees had not realized a real attack was underway. Uber took down internal tools as a precaution and notified law enforcement.

In its September 19 security update (also filed with the SEC as Exhibit 99.1 to a Form 8-K), Uber said an "EXT" contractor's account had been compromised. Uber assessed that the attacker likely purchased the contractor's Uber corporate password on the dark web after the contractor's personal device was infected with information-stealing malware. The attacker repeatedly attempted to log in, and each attempt triggered a two-factor approval request, which the contractor initially declined. Eventually the contractor approved one, and the attacker got in. Uber's post says nothing about out-of-band contact. Dark Reading supplied that: once the contractor had blocked the first requests, the attacker reached them on WhatsApp posing as tech support and told them to accept the prompt. The much-repeated line that the attacker said the notifications would only stop once one was approved traces to the attacker's own messages to security researcher Corben Leo, relayed by BleepingComputer, which said plainly that the account came from the threat actor and had not been verified by Uber.

What happened next survives in two versions, and they are not the same. In messages to Corben Leo, the attacker said he scanned the intranet from the VPN, found a network share holding PowerShell scripts, and took from one of them the username and password of an admin user in Thycotic, Uber's privileged access management platform, then used it to extract secrets for domain admin, Duo, OneLogin, AWS, and G Suite. Every technical write-up naming Thycotic traces back to that message. Uber's own disclosure describes the escalation without any of it: the attacker accessed several other employee accounts, which ultimately gave elevated permissions to a number of tools including G-Suite and Slack. Only Uber's version is first-party.

Uber reported it found no evidence the attacker reached production systems, user accounts, or the databases holding sensitive customer data (credit card numbers, bank details, trip history), and no evidence of codebase changes. The attacker did download some internal Slack messages and information from a finance tool used to manage invoices, and accessed HackerOne vulnerability reports, which Uber said were remediated.

The UK prosecution that followed has produced no conviction for this intrusion. In August 2023 a jury at Southwark Crown Court found that the defendant had done the acts alleged across twelve counts, four of which covered Revolut, Uber and Rockstar Games in September 2022. That was a finding of fact under section 4A of the Criminal Procedure (Insanity) Act 1964, not a verdict of guilt: psychiatrists had assessed him unfit to plead, so the jury was never asked about criminal intent. In December 2023 he was made subject to a hospital order with a restriction order, and in September 2025 the Court of Appeal dismissed his challenge to the findings. That judgment also records that he was aged 16 or 17 throughout the charged period, which is why the widely quoted age of 18 belongs to the trial rather than to the attack.

How it worked

Kill chain at an awareness altitude: (1) Recon/credential sourcing: on Uber's assessment, the contractor's personal device was infected with infostealer malware and the resulting corporate password was bought on a dark-web marketplace, giving the attacker a valid username and password without any technical exploit. (2) Contact/exploitation of MFA: possessing the password but blocked by push-based MFA, the attacker repeatedly triggered login attempts so the contractor's phone was flooded with approval prompts. (3) Rapport/pretext: the attacker reached the contractor out-of-band on WhatsApp, posing as tech support and telling them to accept the prompt. (4) Approval/access: worn down and misled, the contractor approved a prompt, handing the attacker VPN access. (5) Escalation: on the attacker's own account, he found hard-coded admin credentials in a script on an internal share and pivoted into the PAM platform and the secrets it held, while Uber says only that further employee accounts were compromised and yielded elevated permissions. The human failure point was a single MFA approval induced by fatigue plus authority, and the technical failure points were phishable push MFA (no number-matching), broad contractor network reach, and, on the attacker's account, a hard-coded privileged credential.

The lure and the tell

Pretext: a "tech support" message on WhatsApp telling the target to accept the MFA push. On the attacker's own telling, he framed approval as the only way to stop the barrage of notifications. Red flags a defender should notice: a flood of unexpected MFA prompts (you should never approve a request you did not initiate), "IT support" reaching out over an unofficial channel like WhatsApp rather than a verified internal system, urgency and the promise that approving will "make it stop," and any request whose real effect is to grant a login you cannot account for.

Outcome

Attacker gained broad access to Uber's internal tooling and publicly defaced internal channels; Uber disabled tools, reset credentials, rotated keys, locked its codebase, and re-authenticated staff. No evidence of access to production systems or sensitive customer data. Uber strengthened its MFA policies. UK prosecutors put damage to Uber at nearly $3M (2023). The criminal thread is still open. The August 2023 jury finding was a trial of the facts, not a conviction; the indefinite hospital order followed in December 2023; the Court of Appeal dismissed the appeal against the findings in September 2025. In July 2026 the BBC's Joe Tidy reported, after a High Court judge lifted reporting restrictions at his request, that the defendant had been moved out of the secure hospital into an ordinary prison and faces a conventional trial listed for November 2026. That is reporting rather than court record, several outlets carried it but all trace to Tidy, and the scope of the retrial has not been made public. A second defendant was convicted in the same 2023 trial and sentenced to an 18-month Youth Rehabilitation Order, but for offenses against BT/EE and Nvidia, not for this intrusion.

Why it matters

This is a textbook demonstration that MFA is not a silver bullet: push-approval MFA can be defeated by simply exhausting and then deceiving the human on the other end. It shows how commodity infostealer malware plus dark-web credential markets remove the need for any exploit, and how one over-privileged contractor account plus a hard-coded secret can cascade into enterprise-wide compromise. It is a canonical case for training people to reject unexpected MFA prompts and distrust out-of-band "IT support" contact.

Defenses

Phishing-resistant MFA (FIDO2/WebAuthn hardware keys or passkeys) instead of simple push approvals; number-matching and rate-limiting/lockout on repeated push prompts; user training to deny and report unrequested MFA requests and to verify any "IT support" contact through official channels only. Technical controls: eliminate hard-coded/service-account credentials in scripts, enforce MFA on PAM console access, network micro-segmentation to limit contractor VPN reach, least privilege for third parties, and anomaly detection for repeated denied auth attempts.