The Uber data breach began with a hacker purchasing stolen credentials belonging to an Uber employee from a dark web marketplace. An initial attempt to connect to Uber's network with these credentials failed because the account was protected with MFA.

Uber has a well-documented history of security breaches, with the most notable occurring in 2016 and 2022. In the 2016 incident, hackers stole the personal data of 57 million users and drivers, and Uber was later criticized for paying the hackers 100,000todeletethedataandstayquiet.InSeptember2022,ateenagerassociatedwiththe"Lapsus" hacking group gained access to Uber's internal systems, including their Slack and AWS environments, via a social engineering "MFA fatigue" attack. In early 2023, a third-party legal vendor for Uber also suffered a breach that exposed the data of 77,000 employees. As of 2026, Uber has significantly overhauled its security architecture, moving toward "Zero Trust" protocols and hardware-based security keys to prevent similar social engineering attacks. While there have been no major organization-wide breaches reported in the last 12 months, the company remains a high-profile target for cybercriminals due to the vast amount of user data it handles.