Industry News: ESG5

The Target: Uber, the U.S based app ride service.

The Take: Exposure of company internal systems and employee information.

The Vector: A threat actor obtained access to an employee’s user account by convincing them they were part of Uber’s IT team. With the compromised credentials, the attacker accessed all the internal systems the credentials had permissions to view.

This breach is a stark reminder of the very real threat of social engineering attacks which exploit our innate desire to do tasks quickly without stopping to consider the nature of the request. Training, stop-and-think methodology, and a measured approach to requests of any kind, especially where credentials and access are concerned, can help mitigate the risk.

Read more...