They found private authentication information that Uber engineers had accidentally exposed publicly on GitHub, a site many engineers and companies use to store code and track projects. The attack began when hackers got their hands on Uber user data stored on an Amazon server.