ALT-47 · Analysis · 23 Oct 2026
Uber, 2022: push notifications until someone says yes
An attacker with a contractor's password sent repeated login approval requests until one was accepted, then moved through Uber's internal tools. A short case study in MFA fatigue.
- 15 Sep 2022The attacker posts in Uber's Slack; Uber begins its response.
- 19 Sep 2022Uber publishes a security update describing the intrusion.
MFA fatigue
Approval prompts on a phone are easy to say yes to — especially the tenth one, late at night, after a message claiming to be from IT. Push-based multi-factor authentication stops password reuse, but not a determined person on the other end.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Contractors' accounts deserve the same protection as employees'.
- Push approvals without context train people to approve.
- Secrets stored in scripts and shares turn one account into many.
What to do
- Use number matching or phishing-resistant keys instead of plain push approval.
- Rate-limit and alert on repeated MFA prompts for the same account.
- Scan internal file shares and repositories for stored credentials.
Sources
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.
Cite this entry
Altumptic Lab (2026). ALT-47 — Uber, 2022: push notifications until someone says yes. 23 Oct 2026. altumptic.com/research/uber-2022