AWS access key in a private GitHub repository leads to 57 million rider and driver records taken (Uber, 2016)
Between October 13 and November 15, 2016, intruders used an AWS access key that had been posted to a private GitHub repository to access Uber's Amazon S3 datastore.
What happened
- Engineers accessed the repositories through individual accounts without required multi-factor authentication, and the intruders got in using passwords exposed in other breaches.FTC analysis of revised proposed consent order: Uber Technologies
- They downloaded about 25.6 million names and email addresses, 22.1 million names and mobile phone numbers, and 607,000 names and driver's license numbers; Uber did not disclose the breach until November 2017.FTC analysis of revised proposed consent order: Uber Technologies
The failure pattern
Watch the pattern: Weak or phishable authentication on a privileged path
Safeguards that address it
CollectSEA's engineering analysis of what would have prevented or contained this failure.
- Keep secrets out of repositoriesScan for access keys before commit and push, use short-lived role credentials instead of long-lived keys.
- Enforce MFA and unique credentials for code hostingRequire company-managed, MFA-protected accounts so passwords from other breaches cannot be reused.
Related standards
CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.
- IA-2 Identification and Authentication
- RA-5 Vulnerability Monitoring and Scanning
- SI-2 Flaw Remediation
- RV.1.1 Gather vulnerability information from public sources
- RV.2.2 Plan and implement risk responses
- Goal 1 Multi-factor authentication
- Goal 2 Default passwords
- Goal 4 Security patches
- CWE-308 Use of Single-factor Authentication
- CWE-1395 Dependency on Vulnerable Third-Party Component
Building something similar?
Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.
Incidents with the same pattern
Self-replicating "Shai-Hulud" worm compromises more than 500 npm packages by stealing developer tokens (2025)
CISA reported that a self-replicating worm known as "Shai-Hulud" had compromised more than 500 npm packages.
Stolen OAuth tokens from the Salesloft Drift integration are used to export data from customers' Salesforce instances (2025)
From as early as August 8 to at least August 18, 2025, an actor tracked as UNC6395 used compromised OAuth tokens of the Salesloft Drift third-party application to access customers' Salesforce instances.
Malicious code committed to the Amazon Q Developer VS Code extension via a compromised token (AWS, 2025)
Malicious code was committed to the extension's open-source repository using a compromised GitHub token in a build configuration.
Call and text records of nearly all AT&T wireless customers taken from a third-party cloud workspace (2024)
Contractor credentials without MFA accessed third-party cloud data warehouse; downloaded 109 million customer call and text records.
Stolen credentials on a remote-access portal lead to the Change Healthcare ransomware outage (2024)
Single-factor remote access portal breached with stolen credentials; ransomware forced nationwide claims gateway disconnection.
Password spray on a legacy test tenant exposes Microsoft corporate email to a nation-state actor (2024)
Legacy test tenant without MFA compromised via password spraying; adversary created malicious OAuth apps with mail.read privileges.