Uber breach via contractor password and MFA fatigue
On September 15, 2022 an attacker logged in with an Uber contractor's corporate password, likely bought on the dark web after malware infected the contractor's personal device. Repeated login attempts sent the contractor multiple two-factor approval requests until one was accepted. The attacker then reached other employee accounts and gained elevated permissions to tools including G-Suite and Slack, and accessed Uber's HackerOne dashboard.
- Victim
- Uber
- Industry
- Technology
- Country
- United States
- Intrusion began
- Sep 15, 2022
- First disclosed
- Sep 15, 2022
- Actor
- LAPSUS$ (affiliated, per Uber) (Extortion group)
- Initial access
- MFA fatigue
- Identity control that failed
- Authentication
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Number matching or phishing-resistant MFA ends push fatigue, and rate limits on push prompts plus alerts on repeated denials catch it in progress.
Go deeper on SWI
- Teardown: MFA fatigue and push bombing: defeating MFA without breaking it
- Technique: MFA fatigue and push bombing
- Technique: Infostealer credential harvesting
Sources
- Security update, Uber, Sep 19, 2022
- The Uber Hack's Devastation Is Just Starting to Reveal Itself, WIRED, Sep 16, 2022
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Cisco corporate network breach via synced credentials, vishing and MFA fatigue 2022 · MFA fatigue
- AT&T call and text records stolen from its Snowflake workspace 2024 · Stolen credentials
- Neiman Marcus customer data stolen from its Snowflake account 2024 · Stolen credentials
- Advance Auto Parts job applicant data stolen from its Snowflake account 2024 · Stolen credentials
Cite this record
SWI Community Team. (2026). Uber breach via contractor password and MFA fatigue. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2022-uber-mfa-fatigue/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.