Uber responds to ‘cybersecurity incident’
A hacker may have gained access to multiple internal databases at Uber Technologies Inc.
A tweet posted the evening of Sep. 15 on the verified Uber Communications account announced that the company was dealing with some sort of digital breach.
“We are currently responding to a cybersecurity incident,” Uber said in the tweet. “We are in touch with law enforcement and will post additional updates here as they become available.”
According to Bloomberg, on Thursday, Sep. 14, an unidentified individual posted a message on Uber’s internal employee Slack messaging channel stating they were a hacker who had obtained a worker’s Slack login credentials and from there gone on to gain access to internal company databases. They also posted screenshots of content and data from Uber’s internal systems as proof.
Media reports indicate the hacker is an 18-year-old who used social engineering, or using social media to trick someone into revealing personal information that can be used to figure out their usernames and passwords, to gain entry to Uber’s network. Reportedly systems which were compromised included cloud infrastructure hosted by Amazon and Google, as well as system that rewards hackers for finding and reporting security issues in Uber’s network.
Uber has currently shut down its internal Slack messaging system, but there has been no indication any of its transportation or delivery services have been affected. There also has not yet been any sign that any information exposed in the breach has been released, and there have been no public demands for any type of payment or ransom. In 2016, the company paid $148 million in a settlement with U.S. customers who had personal information compromised in a cyberattack.
"We’re in close contact with Uber’s security team, have locked their data down, and will continue to assist with their investigation,” Chris Evans, chief hacking officer of HackerOne, a cybersecurity firm that works with Uber, said in an official statement.
Cybersecurity is a major retail IT issue
According to results of a new survey of 1,420 global IT professionals exclusively released to Chain Store Age by Rackspace Technology, over half (59%) of surveyed retail IT leaders cite cybersecurity as one of their C-suite’s top-three business concerns. At the same time, fewer than four in 10 (38%) retail respondents say they are fully prepared to respond to cybersecurity attacks and threats.
A majority of surveyed retail IT executives report being either unprepared or only “somewhat prepared” to respond to major threats, such as identifying and mitigating threats and areas of concern (67%), recovering from cyberattacks (61%) or preventing lapses and breaches (62%).
When asked to name the consequences of cybersecurity threats/attacks, close to six in 10 (58%) retail respondents mentioned operations downtime and 45% reported loss of intellectual property/data. Other frequently cited consequences include damage to brand reputation (44%) and revenue loss (36%).
And when asked to name the top three cybersecurity challenges their organization is facing, a leading 42% of retail respondents said migrating and operating apps to the cloud led the way, followed by a shortage of workers with cybersecurity skills (39%), and a lack of visibility of vulnerabilities across all infrastructure (37%).