Uber breached by hacker in cyber security incident
“I announce that I am a hacker and Uber has suffered a data breach,”[ads1]; the message reads.
It was followed by a flurry of reaction emojis, including several dozen showing what appeared to be a siren symbol. Because of the hack, the people said, some systems including Slack and internal tools were temporarily disabled.
Internal screenshots obtained by The Washington Post showed that the hacker claimed to have extensive access to Uber’s corporate network and appeared to indicate that the hacker was motivated by the company’s treatment of its drivers. The person claimed to have taken data from common software used by Uber employees to write new programs.
Uber pointed to its tweeted statement when asked for comment on the matter. The company did not immediately respond to questions about the extent to which internal information may have been compromised.
The New York Times first reported the incident.
Uber previously suffered a breach in 2016 that exposed the personal information of 57 million people around the world, including names, email addresses and phone numbers. It also included driver’s license information from approximately 600,000 US drivers. Two people accessed the information via “a third-party cloud-based service” used by Uber at the time.
Uber, which is based in San Francisco, employs thousands of people globally who may have been affected by the hacker’s blocking of its systems. The company has also been criticized for its treatment of drivers, whom it has fought to retain as contractors.
The hacker posted as Uber on a chat feature at HackerOne, which runs interference between researchers who report security vulnerabilities and the companies affected by them. Uber and other companies use this service to manage reports of security flaws in their programs and to reward researchers who find them.
In that chat, seen by The Post, the alleged hacker claimed access to Uber’s Amazon Web Services account.
AWS did not immediately respond to a request for comment. (Amazon founder Jeff Bezos owns The Post.)
In a subsequent interview on a messaging app, the alleged hacker told The Post that they had breached the company for fun and could leak source code “in a few months.”
The person described Uber security as “terrible”.
Uber employees were caught off guard by the sudden disruption to their workday, with some initially reacting to the alarming messages as if they were a joke, according to the screenshots.
The hacker’s ominous post was met with reactions apparently depicting the SpongeBob character Mr. Krabs, the popular “It’s Happening” GIF and questions about whether the situation was a prank.
“Sorry to be a stick in the mud, but I think IT would appreciate fewer memes while dealing with the breach,” said one message seen by The Post.
