In September 2022, within the span of five days, two major companies suffered significant security breaches attributed to the same threat actor. On September 15, Uber disclosed that an attacker had gained deep access to their internal systems, posting a message in their Slack workspace that read "I announce I am a hacker and Uber has suffered a data breach." On September 18, Rockstar Games confirmed that a hacker had obtained confidential footage of the unfinished Grand Theft Auto VI, leaking approximately 90 videos of early development footage to the GTAForums community. Both attacks were attributed to Lapsus$, the extortion group that had spent the previous year hacking some of the most security-mature technology companies in the world.

The Lapsus$ methods were neither subtle nor technically unprecedented. They used social engineering - specifically, targeted vishing calls to helpdesk staff, MFA fatigue attacks (spamming push notifications until a tired employee approves one), and SIM swapping - to bypass authentication systems that were widely considered secure. The group's success was not a story about zero-day exploits or sophisticated malware. It was a story about what happens when organizations build technically sophisticated security systems and then staff them with human beings who can be manipulated.

The Uber Compromise

The attacker who hit Uber in September 2022 - a teenager who claimed to be 18 years old - purchased credentials for an Uber contractor on the dark web. The credentials alone weren't sufficient because Uber used multi-factor authentication. The attacker used MFA fatigue: they sent push notification approval requests repeatedly to the contractor's phone. After being bombarded with requests for over an hour, the contractor approved one. The attacker then texted the contractor directly, posing as Uber IT support, explaining that the approval was necessary and legitimate. The social engineering layer provided cover for the technical attack.

With contractor-level access established, the attacker pivoted to internal systems. They found an internal network share that contained PowerShell scripts. Within one of those scripts was a hardcoded admin credential for Uber's privileged access management (PAM) system. With PAM admin access, the attacker could retrieve credentials for essentially any system in Uber's environment - AWS, Google Cloud, Slack, HackerOne (Uber's bug bounty program), Uber's internal bug tracker (which contained vulnerability reports that hadn't been patched yet), and more. The breadth of access was comprehensive.

The attacker sent the Slack message announcing the breach and posted screenshots of Uber's AWS management console, internal dashboards, and other systems to prove the access was real. Uber's security team, realizing the account was compromised, initially tried to remove the attacker from Slack - but the attacker responded to each removal by logging back in. Uber eventually took Slack offline entirely. The attacker also accessed Uber's HackerOne program, downloading bug reports. Uber contacted HackerOne to redact the reports, concerned that outstanding vulnerability disclosures were now in the attacker's hands.

[TECHNICAL NOTE]
The Uber attack illustrated a failure mode that has become common in large enterprises: privileged credentials stored in scripts or configuration files that are accessible to users who shouldn't have them. The PAM credential in the PowerShell script wasn't an accident - it was put there by a developer or administrator who needed the script to run without interactive authentication. This pattern (hardcoded credentials in code or config files on internal shares) is one of the most common findings in enterprise penetration tests, and one of the most impactful when exploited. The correct pattern is to use service accounts with scoped permissions, secrets management platforms (HashiCorp Vault, AWS Secrets Manager), or credential-free machine identity systems. The "one-stop shop" nature of PAM compromise - where a single credential gives you a master key to the credential store for all other systems - is exactly why PAM systems are high-value targets and why their own credentials need exceptional protection.

Rockstar and the GTA VI Leak

Three days after the Uber breach, the same attacker (or a Lapsus$ affiliate using the same methods) posted 90 videos of Grand Theft Auto VI development footage to GTAForums. The videos showed early builds of the game, character models, engine details, and internal development tooling. For the gaming community, this was the most significant leak in years. For Rockstar Games' parent company Take-Two Interactive, it was an embarrassing and commercially damaging exposure of one of the most anticipated games in history, years before planned release.

The attacker also claimed to have obtained GTA V and GTA VI source code and threatened to release it unless Rockstar negotiated. The Rockstar breach appeared to use Slack as the entry point - the attacker claimed to have accessed Rockstar's Slack workspace directly and downloaded the internal development footage from there. This would be consistent with the same social engineering pattern used at Uber: compromised employee credentials used to access collaboration tools where sensitive material was stored.

The attacker who conducted both the Uber breach and the Rockstar breach was arrested in London on September 22, 2022 - four days after the GTA VI leak. He was 17 years old at the time of arrest. He was one of several individuals linked to the Lapsus$ group who had been identified and arrested during a broader UK police operation. A second individual was arrested in the same sweep. The core Lapsus$ group, which had conducted a string of high-profile breaches through 2021-2022, was largely disrupted by these arrests.

[WARNING]
The Lapsus$ attacks on Uber, Rockstar, Microsoft, Nvidia, Samsung, Okta, T-Mobile, and others between 2021 and 2022 shared a consistent theme: technically sophisticated security infrastructure bypassed through human-layer attacks. MFA fatigue, helpdesk vishing, SIM swapping, and insider recruitment (Lapsus$ openly advertised willingness to pay insiders at target companies) all exploited the reality that authentication ultimately depends on humans making correct decisions under time pressure. The group's age profile was unusual: multiple core members were teenagers, including the UK member arrested at 17 and a Brazilian member arrested at 16. This created a specific challenge for prosecutors - the Computer Fraud and Abuse Act and UK Computer Misuse Act both have provisions for minor offenders, and significant hacks by minors create uncomfortable sentencing questions. The UK defendant received an indefinite hospital order in 2024 after his autism diagnosis factored into sentencing. The tension between the severity of the breaches and the age of the perpetrators characterized much of the legal aftermath.

The MFA Fatigue Problem

MFA fatigue - sending repeated push notification requests to a target in the hope that they'll approve one out of confusion or frustration - had been a known attack technique for years before the Lapsus$ breaches, but the group's high-profile use of it prompted widespread industry reassessment of push-based MFA. The problem is specific to "approve/deny" push notifications: when the target is flooded with approval requests from their authenticator app, a sufficiently persistent attacker can eventually get an approval, especially if combined with a phone call or text message providing social cover.

The recommended mitigations post-Lapsus$ included: phishing-resistant MFA (FIDO2/WebAuthn hardware keys or passkeys, which cryptographically bind authentication to the legitimate domain and cannot be replicated in MFA fatigue attacks); number-matching MFA (requiring the user to type a number displayed on the login screen into the authenticator app, adding friction that eliminates accidental approvals); and contextual MFA policies that flag unusual login locations or times before presenting the approval request. Microsoft, Okta, and Duo all shipped number-matching features in their authenticator apps following the 2022 wave of fatigue attacks.

[IOC]
Lapsus$/Uber-style attack indicators: MFA fatigue is detectable as an unusual burst of authentication push notification events for a single account, typically dozens of requests in a short window. Uber's SIEM should have flagged the repeated PAM access pattern and the lateral movement from contractor account to privileged internal scripts. Hardcoded credentials in scripts accessible from low-privilege shares are a persistent enterprise vulnerability that should be caught in code review and secrets scanning (tools: truffleHog, git-secrets, GitHub Advanced Security secret scanning, Semgrep rules for credential patterns). Initial indicators of Lapsus$-style compromise in Slack/Teams environments: unusual external login from new geography, high-volume channel browsing or file downloads immediately post-login, access to channels not previously accessed by the account. The UK-arrested Lapsus$ member used the handles "teapotuberhacker" and "WhiteDoxbin." The Rockstar leak was posted to GTAForums under "teapotuberhacker." The broader Lapsus$ group used Telegram for coordination and public announcement of their compromises.