Uber security incident involving compromised credentials and internal access
Uber disclosed a security incident in September 2022 in which an attacker gained access to internal systems after obtaining credentials and leveraging social engineering techniques. The incident drew attention to MFA fatigue/social engineering risks and internal tooling exposure. The U.S. Cyber Safety Review Board (CSRB) later analyzed related intrusions in the period (including Lapsus$ activity), emphasizing systemic identity and access control weaknesses exploited through social engineering.
First reported September 17, 2022Breachmed overall confidence
Uber employees and internal systems potentially accessed during the incident
Initial access
stolen_creds
phishing
Impact
data_theft
unknown
Attribution
Lapsus$ (suspected/associated)med confidence
Public reporting and incident analyses frequently associate the incident with Lapsus$ tactics; Uber’s disclosure focuses on access method and remediation.
T1078: The attacker used valid credentials to access internal systems.
T1566: The incident involved social engineering to obtain or reuse credentials and drive access.
Mitigations
Now
Enforce phishing-resistant MFA for workforce and privileged accountsReduces successful account takeovers from stolen passwords and common social engineering techniques.
Soon
Harden helpdesk and password reset workflowsPrevents attackers from using social engineering to reset MFA or regain access via the identity recovery channel.
Later
Apply conditional access and session risk controls (device posture, geo, impossible travel)Limits account abuse by requiring stronger signals for high-risk sign-ins and reducing lateral access after compromise.
Detection ideas
Alert on anomalous authentication patterns
Flag first-time device logins, new geo/ASN, impossible travel, and sign-ins immediately followed by privilege escalation or access to sensitive apps.
