July 20, 2026, 11:46 a.m.

Uber 2022 Cyber Attack: How an 18-Year-Old Hacker Gained Full Access

In September 2022, an event that shook the technology world occurred. Uber, one of the world's largest transportation technology companies, was completely compromised by an 18-year-old hacker. This incident became a case study full of important lessons for corporate cybersecurity and revealed how even large companies can neglect basic security principles. So how exactly did a young hacker manage to gain access to all systems of a billion-dollar company?

Lapsus$ Group and New Generation Cyber Threat Actors

The young hacker who carried out the attack was affiliated with the Lapsus$ group, which was beginning to make a name for itself in the cybersecurity community at that time. This group had attracted attention especially in 2022 with successful attacks against tech giants like Microsoft, Nvidia, Samsung, and Okta. The Lapsus$ group adopted a different approach from classic ransomware gangs: they preferred a strategy of leveraging social engineering and basic security vulnerabilities rather than sophisticated malware.

This approach underscored an important truth: the weakest link in the corporate cybersecurity chain was still human. Even the most advanced security technologies could easily be bypassed with the right social engineering tactics. The Uber case would become one of the most striking examples of this thesis.

Anatomy of the Attack: The Path from WhatsApp to Full Access

First Step: Compromising Credentials

The attack began with a much simpler method than expected. The hacker used the username and password of an Uber employee that they had purchased on the dark web or obtained from a previous data breach. At this stage, they encountered multi-factor authentication (MFA) - a system that theoretically serves as a security layer. However, the attacker would use an extremely effective technique to overcome this obstacle.

MFA Fatigue Attack: A Psychological Rather Than Technical Tactic

MFA fatigue attack is one of the most insidious social engineering tactics encountered in modern cybersecurity. In this method, the attacker continuously sends MFA approval requests to the target user. The user initially rejects these requests, but the attacker doesn't give up and continues sending these requests for hours.

In the Uber case, the targeted employee began receiving dozens of MFA notifications until late at night. Eventually, either to get rid of the annoyance or thinking it was a legitimate IT request, the user approved one of these prompts. This single click was enough for the attacker to gain access to Uber's VPN network.

WhatsApp Social Engineering: IT Support Impersonation

But the attacker went even further. They contacted the targeted employee via WhatsApp, introducing themselves as someone from Uber's IT department. They told them that the continuous MFA notifications were a security test and that the employee needed to approve these tests. This tactic was a classic example of using an "authority figure" and unfortunately, it worked.

This stage shows how critical corporate security training is. Employees should be trained to be suspicious of communication attempts outside official channels and regarding authentication. IT departments should never request sensitive operations through informal channels like WhatsApp, personal email, or phone.

Internal Propagation: Privilege Escalation and Lateral Movement

After obtaining VPN access, the attacker began lateral movement within Uber's internal network. The landscape they encountered was surprising: while navigating the internal network, they found hardcoded administrator credentials within PowerShell scripts. This was one of the most basic mistakes that could be made in corporate security and handed the attacker a golden opportunity for privilege escalation.

Full Access to Critical Systems

With these administrator credentials, the attacker infiltrated Uber's most critical systems:

• Amazon Web Services (AWS) - The heart of the company's cloud infrastructure
• Google Cloud Platform (GCP) - Data storage and processing systems
• Slack - Internal communication platform and sensitive corporate information
• HackerOne - Ironically, the platform where security vulnerabilities are reported
• Internal code repositories - Access to Uber's source code
• Databases - Systems containing customer and company data

This comprehensive access meant that the attacker had taken control of almost all of Uber's digital assets. Theoretically, they could steal customer data, delete systems, or completely shut down services.

'Epic Fail' Message: The Attack Is Revealed

To prove their access, the attacker posted a message on Uber's internal Slack channel announcing their presence. In their message titled "I announce I am a hacker and Uber has suffered a data breach," they shared screenshots of the systems they had compromised. The phrase "epic fail" at the end of the message became a symbol of how devastating the attack was both for Uber's security vulnerabilities and its reputation.

Interestingly, employees initially thought this message was spam or a joke. However, the shared evidence and the beginning loss of access to systems revealed the seriousness of the situation. Uber management activated their emergency action plan, beginning to shut down systems and assess the damage.

Internal Security Collapse: Where Were the Mistakes Made?

Multi-Layered Security Failures

The Uber case resulted not from a single security vulnerability, but from a chain of multiple interconnected failures:

1. Identity and Access Management (IAM) Vulnerabilities: Credentials obtained from previous data breaches remaining active, inadequate password policies, and credential