Uber Probes Hacker’s Claim to Have Penetrated Key Databases

(Bloomberg) -- Uber Technologies Inc. has shut down internal Slack messaging as it investigates a cybersecurity breach by a hacker claiming to have accessed sensitive company data.

Employees on Thursday received a Slack message from an unknown person claiming “I am a hacker,” according to one person with knowledge of the matter. The perpetrator co-opted a staff member’s account and claimed to have gained access also to internal databases, the person said. The cyberattacker was an 18-year-old who managed to infiltrate a plethora of internal systems, providing snapshots of emails and code repositories to prove his exploits, the New York Times reported.

Uber shares fell 5.2% in pre-market trading in New York Friday. 

The perpetrator or perpetrators appeared to have gained access to part of Uber’s Amazon and Google-hosted cloud infrastructure, said Sam Curry, a researcher with Yuga Labs who said he had been in contact with the attacker. They also got into the “HackerOne” system, which helps Uber with a so-called bug bounty program that rewards hackers for exposing and reporting vulnerabilities.

“Pretty much everything,” Curry said when asked what got compromised. “They had access to all of HackerOne’s reports.” An Uber representative confirmed a breach had occurred but declined to elaborate.

Related:Why Online Storage Services Are Prime Targets for Phishing Attacks

The company, which said on Twitter it’s contacted law enforcement, froze all Slack communications while it investigates the hacker’s claims. Uber’s ride-hailing and food delivery services appeared to be operating normally across the world, the people said.

Uber has run afoul of hackers before. It paid $148 million to settle claims related to a large-scale data breach that exposed the personal information of more than 25 million of its US users in 2016. The New York Times reported the latest hack earlier on Thursday.

“HackerOne supports its customers. We’re in close contact with Uber’s security team, have locked their data down, and will continue to assist with their investigation,” Chris Evans, its chief hacking officer, said in a statement.