Lapsus$: teenagers who talked their way into big companies

The story

Lapsus$ was an extortion group that appeared in late 2021. Over the next year it broke into large companies including Microsoft, Nvidia, Samsung and Uber, then stole data and threatened to release it. Police in the UK and Brazil arrested several members, at least two of them teenagers.

The group’s methods were simple:

• Social engineering. Calling help desks and employees while pretending to be someone else.
• MFA fatigue. Sending a stream of sign-in approval requests to an employee’s phone until they tapped “approve.”
• SIM swapping. Getting a phone carrier to move a victim’s number to a new SIM, so sign-in codes went to the attacker.
• Insiders. Recruiting employees to hand over their logins.

Once it had one employee’s access, the group looked for administrators and remote access tools to go further.

Why it mattered

Lapsus$ showed that some of the largest technology companies in the world could be breached with phone calls, persuasion and worn-down employees, without advanced hacking tools. A federal board that studies major cyber incidents reviewed the group’s methods in 2023.

The lesson today

Each of these methods targets a person. Multi-factor authentication that shows a number to match, help desks that verify callers before resetting anything, and staff who know never to approve a sign-in they did not start close most of those doors.