On September 15, 2022, Uber's security team began receiving unusual Slack messages. An account within the company's Slack workspace had posted the words "I announce I am a hacker and Uber has suffered a data breach" and proceeded to tag multiple internal engineering channels with a graphic image. Within hours, the attacker had access to Uber's HackerOne vulnerability disclosure program - where confidential security reports from external researchers were stored - the company's internal ticketing systems, the code repositories, and a dashboard showing access to AWS, Google Cloud, and Azure resources. Uber's engineers had to take the extraordinary step of telling employees to stop using Slack entirely while the intrusion was assessed.
The same week, a hacker identifying themselves as "Teapotuberhacker" posted on GTAForums claiming to have breached Rockstar Games, the makers of Grand Theft Auto. They attached 90 video clips of GTA VI gameplay footage - content so clearly authentic that Rockstar issued a statement confirming the leak and calling it "extremely disappointing." The clips included early development build footage that the gaming community had been speculating about for years. They were never supposed to be public.
Both breaches were the work of the same 17-year-old from Oxford, England, who used the handle "teapotuberhacker" and who, at the time of the Rockstar breach, was on bail for previous offenses related to hacking. He was Arion Kurtaj, one of the core members of LAPSUS$. The Metropolitan Police had arrested him in March 2022 as part of the LAPSUS$ investigation, released him on bail with conditions, and then watched him hack two major companies from a hotel room using a Fire TV Stick, a phone, a keyboard, and whatever services were available to him through the hotel network.
The Uber Intrusion: Social Engineering Through MFA Fatigue
The Uber breach was a textbook MFA fatigue attack combined with a direct social engineering escalation. The attacker obtained an Uber contractor's login credentials - likely purchased from a credential market or obtained through previous phishing - and then began attempting to log in repeatedly. Each login attempt triggered an MFA push notification to the contractor's phone, asking them to approve or deny.
After approximately an hour of push notifications, the contractor was exhausted. The attacker then sent a WhatsApp message to the contractor claiming to be from "Uber IT" and telling them that the only way to stop the push notifications was to approve one. The contractor did.
This combination - credential stuffing triggering MFA fatigue, then social engineering the victim into approving - was the same technique that had worked against Okta, Microsoft, Cisco, and a dozen other companies during the LAPSUS$ campaign. The effectiveness rate was high enough that security professionals had moved to calling it not just a technique but a primary attack vector for well-resourced adversaries targeting enterprises with MFA-protected accounts.
Once inside the contractor's account, the attacker found what would become the most consequential step: a network share containing PowerShell scripts, one of which contained hardcoded credentials for a privileged account. From there, the attacker was able to access Thycotic - Uber's Privileged Access Management system - and use it to obtain credentials for essentially every other internal service.
The PAM system access was the critical escalation. Privileged Access Management tools are designed to be the secure vault where sensitive credentials are stored. If an attacker reaches that system, they have the keys to everything. Uber's implementation apparently had a configuration that allowed a compromised user account to access the PAM tool's administrative interface without additional authentication barriers specifically protecting that escalation path.
What Was Accessed
The attacker's subsequent access was comprehensive. The HackerOne program access was particularly damaging - it contained detailed vulnerability reports from external security researchers that Uber had not yet remediated. In effect, accessing that program handed the attacker a roadmap of Uber's known unfixed security vulnerabilities, each described in the detail that researchers provide to help companies reproduce and fix issues.
The attacker also accessed Uber's internal Slack, where they posted announcements of the breach while still inside the network. This was characteristic of the LAPSUS$ style: the performance of the breach was part of it. The group had developed a reputation for conducting live Q&A sessions while actively inside victim networks, taunting security teams, and treating the intrusion as entertainment as much as a financial or informational operation.
Uber stated that no user data was accessed - no trip history, payment information, or personal details of riders or drivers. The company's customer-facing systems had better isolation from the internal corporate infrastructure than the corporate infrastructure had from itself. The damage was primarily internal: exposure of engineering systems, security tool configurations, and the HackerOne reports.
The Rockstar Breach: From Hotel Room with a Fire TV Stick
The Rockstar breach was conducted while Kurtaj was on bail, housed in a hotel by police (apparently after concerns about his home environment), with conditions including no internet access. The investigation later revealed that he had obtained a Fire TV Stick, keyboard, and phone, connected them to the hotel's network, and used that limited setup to breach Rockstar Games and the proprietary Slack-integrated environments used by the game development studio.
The technical method was not publicly confirmed in detail, though the Rockstar intrusion followed the same broad pattern as the Uber breach - social engineering into initial access, then lateral movement to valuable targets. Rockstar Games used Slack extensively for development coordination, and gaining access to internal Slack channels allowed the attacker to find credentials for development build storage and the internal systems containing GTA VI footage.
The 90 clips of GTA VI footage that were leaked included gameplay mechanics, development build UI showing debug menus and developer tools, audio placeholders, and a very early view of what was clearly a large and ambitious game. The gaming community reacted with a combination of excitement at the confirmed existence of the footage and dismay at the circumstances of its release. Rockstar's parent company Take-Two Interactive stated it intended to pursue the perpetrators vigorously.
Arion Kurtaj: Profile and Trial
Arion Kurtaj was 16 when the LAPSUS$ campaign began and 17 or 18 through most of the most significant intrusions. He was identified by UK police as part of the LAPSUS$ investigation, arrested in January 2022, re-arrested in March 2022, released on bail with conditions including no internet access - and then conducted the Uber and Rockstar breaches in September 2022 while on that bail.
At trial at Southwark Crown Court in 2023, Kurtaj was found to be unfit to stand trial due to his autism - he could not participate meaningfully in his own defense. A jury of fact was nonetheless convened to determine whether he had committed the acts he was charged with. The jury found that he had. Judge Linden KC sentenced him to an indefinite hospital order, meaning he would remain in secure psychiatric care until clinicians determined he no longer posed a risk, with no maximum term. At 18, he faced the prospect of indefinite detention without a fixed release date.
A second defendant, a 17-year-old who could not be identified, was found to have committed similar offenses and received an 18-month youth referral order. Several other LAPSUS$ members had previously been charged in other jurisdictions.
The COM Connection and Structural Implications
Kurtaj and the other LAPSUS$ members were not isolated prodigies. They were participants in "the COM" - a loosely organized online community centered on Discord and Telegram servers, with roots in SIM swapping, OG username theft, and cryptocurrency fraud, and overlapping significantly with the communities that produced Scattered Spider, the group later responsible for the MGM and Caesars attacks.
The COM provided a support structure that amplified individual capabilities: a community of people with complementary skills (some with social engineering ability, some with technical skills, some with access to credential markets and SIM swappers), shared information about techniques that worked, competitive reputation incentives that motivated escalating attacks, and enough scale that even law enforcement action against individuals did not eliminate the community's collective capability.
What the Uber, Rockstar, and preceding LAPSUS$ attacks demonstrated was that this community could produce results that matched or exceeded what nation-state actors were achieving, using methods that were primarily social rather than technical. The attacks on Nvidia, Microsoft, Samsung, Okta, T-Mobile, Uber, and Rockstar used variants of the same core technique: MFA fatigue or push notification bombing, combined with social engineering help desk staff, combined with patient exploration of internal systems once initial access was obtained. None of this required novel malware, sophisticated exploits, or significant technical sophistication beyond the social engineering skill of navigating corporate phone trees convincingly.
Enterprise Security Failures the Breaches Revealed
The Uber breach's post-mortem identified several failures that security professionals had been warning about:
Hardcoded credentials in scripts are a persistent problem. The PowerShell script that gave the attacker privileged access should not have contained a password in plaintext. The solution is not primarily technical - credential management tools exist and work - it is organizational: requiring that scripts go through security review before deployment, detecting hardcoded credentials in code repositories, and auditing internal file shares for documents containing sensitive credentials.
PAM tools are high-value targets. If all sensitive credentials are stored in one system, that system requires the highest level of protection - not just authentication but step-up authentication for administrative access, behavioral alerting for unusual access patterns, and network segmentation that prevents compromised user accounts from reaching the administrative interface at all.
MFA configuration matters more than MFA presence. Having MFA enabled is necessary but not sufficient. Push-based MFA is exploitable through fatigue attacks. The migration from push notifications to FIDO2/passkeys/hardware tokens, or at minimum to number-matching prompts, became a standard recommendation in enterprise security guidance after the LAPSUS$ campaign demonstrated how systematically push MFA could be defeated by patient social engineers.
The speed of the Uber intrusion - from contractor credential compromise to HackerOne access within hours - also highlighted how quickly a determined attacker with initial access can move through an enterprise network when internal trust boundaries are weak. Zero-trust architecture, which treats every access request as potentially hostile regardless of whether it comes from inside the network, represents the structural response to this problem - though implementing it across a complex enterprise environment is a years-long effort.