top of page

Uber Data Breach


On Thursday, Uber announced that a cybersecurity issue is being investigated following claims that the ride-hailing business had been hacked.




In an article published in the New York Times, it was reported that hackers hacked an Uber employee's Slack account in order to gain control of Uber's internal systems. For regular interaction, many tech companies and startups use Slack, a workplace messaging platform. Slack has now been disabled by Uber, according to multiple sources.


There was a 55 percent drop in Uber's stock price. As reported by the Times, the hacker penetrated Uber's internal slack through a social engineering attack and then gained access to other corporate systems. During a slack chat, the hacker claimed that Uber had suffered a data breach and he claimed to be a hacker.


As the Times reported, the hacker accessed additional internal databases after infiltrating Uber's internal slack system using a social engineering technique.


Employees at the ride-hailing and food delivery company were prevented from using internal tools, including Slack, because of a breach in their system. In one employee resource page, the hacker is said to have posted an image that was not safe for work. Rather than being involved in the breach, a bug bounty hunter and security engineer from a different company submitted a statement alleged to come from an anonymous Uber employee that claims they have been told to cease using Slack and that they are being sent to inappropriate websites and messages every time they request a webpage.


Using the hashtag # uberunderpaisdrives, bounty hunters posted a screenshot allegedly from the hacker declaring, "I am a hacker and Uber has had a data breach."

An Uber employee appears to have been informed about the hacker by posting a message on the company's internal slack system. I regret to inform you that I am a hacker and that Uber has had a data breach.


Several Uber employees initially mistook the alleged hacker's Slack message for a joke because it was so brazen. A lighthearted GIF and empojis like sirens and pop corn were some of the responses employees posted to the post. Staff at Uber thought they were playing a joke on the hacker, a former employee told Sam Curry.


Researchers say that the hacker gained access to Uber's account with security company Hackerone, then gave him images of the company's cloud accounts and Google tools.

It's unclear how the attack was discovered, and the Wall Street Journal claims it hasn't been able to corroborate the hacker's claims. This covers whether or not the hacker identified himself or herself as Tea Pot.


Teapot has claimed to be the hacker and has allegedly stated that the attack was carried out by duping an Uber employee into allowing them access to the company's private network.


If the breach is as bad as has been claimed, it will not be the company's first major breach.

Joe Sullivan, the former Uber security head, was sacked following a data breach in 2016. He is on trial this week on charges that he paid the hackers ransom to conceal the fact that there had been a breach. This is denied by Sullivan.

42 views0 comments

Recent Posts

See All

Attack on Florida Hospital

According to the healthcare network, an apparent cyberattack has forced some emergency patients to be transferred to other facilities and some non-emergency surgeries to be cancelled. Tallahassee Memo

Comments


bottom of page