On September 15, 2022, a hacker used a compromised Uber EXT account to access the company's internal systems after an employee's personal device became infected with malware and their login credentials posted to the dark web.

As of early 2026, the last major, high-profile cyberattack on Uber occurred in September 2022. In this incident, an 18-year-old hacker associated with the group Lapsus$ used social engineering—specifically an "MFA Fatigue" attack—to trick a contractor into granting access to the company's internal systems. The hacker gained deep access to Uber's Slack, Amazon Web Services (AWS), and Google Workspace. While the attacker posted screenshots of internal dashboards and source code, Uber maintained that no sensitive customer or driver data, such as trip histories or credit card numbers, was stolen. This followed a much more controversial breach in 2016, where hackers stole data for 57 million users, and Uber famously paid a $100,000 ransom to keep the event quiet—a decision that later led to federal prosecution of the company's former security chief. While Uber has significantly bolstered its "Zero Trust" security architecture since 2022, these events remain a landmark case study in the risks of human-targeted social engineering.