### Overview
The attackers targeted Uber's vulnerability disclosure program, exfiltrating sensitive HackerOne reports.

### Details
- **Objective:** To gather exploit information and security weaknesses.
- **Method:** Used compromised credentials to access and download reports.

### Indicators of Compromise (IoCs)
- Data transfers to external IPs from internal vulnerability systems.
- Access logs showing atypical download patterns.

### Recommendations
- Conduct an audit of access logs for sensitive systems.
- Ensure encrypted channels for internal data handling.