Uber 2022 Breach: Teenage Hacker Compromises Internal Systems via Social Engineering

The attacker repeatedly sent MFA push notifications to an Uber employee until they accepted one, then posed as IT support via WhatsApp. Once inside the attacker accessed Slack, source code, financial dashboards, and critically HackerOne vulnerability reports.

The breach at Uber exposed Internal systems compromised; limited customer data impact records through mfa fatigue attack followed by social engineering via whatsapp. Limited direct customer impact; internal systems broadly compromised The incident highlights the ongoing challenges organizations face in protecting sensitive user data against increasingly sophisticated attack vectors. Security researchers have noted that breaches of this magnitude often result from a combination of technical vulnerabilities and organizational failures in security practices.

Current status: Kurtaj found unfit to stand trial; held at secure hospital. Affected users should take immediate steps to protect their accounts, including changing passwords, enabling multi-factor authentication, and monitoring financial accounts for unauthorized activity. Filing a DSAR with Uber can help you understand what data was exposed and request its deletion.