Lapsus$ Member Compromises Uber & Rockstar Games – In The Same Week

Introduction

A hacker who goes by the alias “teapotuberhacker” managed to hack into two major organizations. Although no major data was leaked from either company, it was noted by Uber that the hack was “a total compromise. In both cases, it seems like social engineering played a huge part in the hacker gaining access to the companies and their internal slack channels.

Uber

While the Rockstar Games hack was bare – the hacker managed to steal about an hour’s worth of footage from an unreleased game – the Uber hack was much different. By claiming to be IT and spamming an employee with requests to grant access, “teapotuberhacker” was able to gain their initial access. From there, he went on to make a post on Uber’s internal slack channel from an employee’s account, where they went on to state “I announce I am a hacker and Uber has suffered a data breach.” Along with this was a list of several internal databases that the hacker also claimed to be compromised. Later posting an explicit image along with another list of databases that he had compromised, providing screenshots to prove his access. Thankfully, no major data was compromised or extorted from Uber and the hacker appeared to have gained access simply because he could and “the company had weak security.”

The following day, Uber released a security update detailing some of the attack. They claim the attacker did not access any production systems that would store user information, such as trip history or credit card information. Although this seems like a good thing, this was a close call for Uber, who just a few years prior in 2016, had 57 million driver and rider accounts compromised and those hackers wanted Uber to pay up big time for the deletion of their copy of the information. Uber caved to the requests and ended up paying $100,000 and kept the secret of the breach for more than a year.

As we know, covering up a security breach like that is very illegal. All 50 states including United States territories have laws involving the security breach of personal data and disclosure to the applicable parties. Since this was not followed by Uber in this 2016 case, Uber’s top security executive at the time, Joe Sullivan, was fired for his role in the hack.

The Consequences

The now identified 17-year-old hacker comes from Oxfordshire in Britain. The City of London Police Twitter account has released a statement detailing that “London Police arrested a 17-year-old in Oxfordshire on suspicion of hacking”. The teenager was charged with two counts of violating his bail and two counts of violating Britain’s computer misuse law. He now remains in police custody and will be held in a youth detention center.

– Christopher Calvani 10/5/22

Sources

Recent Data Breaches – October 2022

https://www.uber.com/en-GB/newsroom/security-update/

https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business

What happened to the hacker behind gaming’s biggest GTA 6 leak?