“I announce that I am a hacker and Uber has suffered a data breach,” the message read.
It was followed by a flurry of reaction emoji, including several dozen showing what appeared to be siren symbols. Due to the attack, the people said, some systems, including Slack and internal tools, were temporarily disabled.
Internal screenshots obtained by The Washington Post showed that the hacker claimed to have extensive access to Uber’s internal corporate networks and seemed to indicate that the hacker was motivated by the company’s treatment of its drivers. The person claimed to have taken data from common software used by Uber employees to write new programs.
Uber pointed to his tweeted statement when asked for comment on the matter. The company did not immediately respond to questions about the degree to which internal information may have been compromised.
Uber waits a year to report massive customer data hack
The New York Times first reported the incident.
Uber previously suffered a breach in 2016 that exposed personal information of 57 million people around the world, including names, email addresses and phone numbers. It also included driver’s license information for approximately 600,000 US drivers. Two people agreed the information through “a third-party cloud-based service” used by Uber at the time.
San Francisco-based Uber employs thousands of people around the world who may have been affected by the hacker’s clogging of systems. The company has also come under fire for its treatment of drivers, whom it has struggled to keep as contractors.
The hacker posted as Uber in a chat feature on HackerOne, which interferes between researchers reporting security vulnerabilities and companies affected by them. Uber and other companies use that service to manage reports of security flaws in their programs and reward researchers who find them.
In that chat, which was seen by The Post, the alleged hacker claimed access to Uber’s Amazon Web Services account.
What to do if you get hacked
AWS did not immediately respond to a request for comment. (Amazon founder Jeff Bezos owns The Post.)
In a later interview on a messaging app, the alleged hacker told The Post that they had gotten into the company for fun and could leak the source code “in a few months.”
The person described Uber’s security as “horrible.”
Peiter “Mudge” Zatko’s journey from hacker to Twitter whistleblower
Uber employees were caught off guard by the sudden interruption to their workday, with some initially reacting to the alarming messages as if they were a joke, according to screenshots.
The hacker’s ominous posts were met with reactions apparently depicting the SpongeBob character Mr. Krabs, the popular “It’s Happening” GIF, and questions about whether the situation was a joke.
“Sorry to be a stick in the mud, but I think IT would appreciate fewer memes as they handle the breach,” read a message seen by The Post.