A contractor's fatigue let one attacker into Uber's internal tools

What happened

On 15 September 2022, an intruder obtained an Uber contractor's corporate password, according to Uber's own security update, likely purchased after the contractor's personal device was infected with malware. Multi-factor authentication initially blocked repeated login attempts, but after roughly an hour of repeated push notifications the contractor approved one, and the intruder signed in. From there, Uber said the attacker reached internal tools including an admin console, the company's Slack workspace and its bug-bounty platform, and downloaded some internal Slack messages and finance-related data. Uber's update, last revised on 19 September 2022, stated it found no evidence the attacker reached the production systems that serve riders and drivers, the codebase, or the databases holding sensitive customer information.

Confidence and limits

The account of what was and was not accessed comes from Uber's own investigation as it described it in the days following the intrusion; this article has not opened an independent forensic or regulatory report confirming the full scope. The technique, colloquially called MFA fatigue or push bombing, is separately documented as a pattern in the Cyber Safety Review Board's review of Lapsus$ and related groups, which described comparable social-engineering methods used against other companies in the same period, though that review does not itself analyze the Uber intrusion.

Why it mattered

The incident showed that push-based MFA, long treated as a strong improvement over passwords alone, has a human failure mode: a person who receives enough unexplained approval requests may eventually tap accept out of habit, confusion or fatigue rather than deliberate compromise. CISA's fact sheet on the subject, published the following month, recommended number matching, requiring a user to type a code shown on the login screen into the authenticator app, as an interim step for organizations not yet ready to move to phishing-resistant hardware or platform authenticators.

Defensive takeaway

If your organization still relies on simple push-approval MFA, enable number matching immediately as an interim measure and treat repeated unexplained push prompts, approved or not, as a reportable security event rather than routine noise.

• Would an employee who received a dozen unexpected login prompts in an hour know to report it rather than approve one to make the notifications stop?
• Does your MFA system support number matching or phishing-resistant methods such as FIDO2 security keys, and is either one required for administrative accounts?
• Are contractor accounts held to the same authentication and monitoring standard as full-time employee accounts with similar access?

Uber's account describes a contractor's fatigue and a purchased password, not a novel technical exploit, which is part of why the incident spread so quickly through security teams elsewhere as a cautionary example rather than a one-off curiosity.