Uber Suffers Breach, Vulnerability Reports Stolen

What happened?

• Uber has confirmed that its high-security internal systems suffered a data breach by a hacker who claims to now have access to the company’s sensitive data. The company tweeted that it is investigating the incident, along with law enforcement authorities.
• The attackers provided screenshots of the company's IT systems, Windows domain, Slack server, and email dashboard. 
• They additionally appeared to have access to Uber's Amazon Web Services dashboard and Google-hosted cloud infrastructure and used them to issue breach notifications.

Diving into details

• As per The New York Times report, the operator carried out a social engineering attack on an employee’s Slack account to gain initial access.
• An internal message was sent by the hacker from the compromised Slack account to the rest of the Uber employees, informing them about the breach.
• The hacker made use of the stolen credentials to gain access to the company’s internal systems containing classified information. It is not known if any customer data has been compromised. 
• The breach has reportedly given the bad actor access to all private vulnerability reports on HackerOne, which is Uber’s bug bounty program. 

Conclusion