Moderately tangential, but I just had my Uber account hacked today. I also used a strong, unique password managed by a password manager. As far as I can tell, my email wasn’t hacked (Google Workspace account backed by a physical security key). My best guess is they scammed support, but I am just taking a stab in the dark.

The worst part is, you can’t even talk to Uber support chat unless you put in the account’s current email, phone number, and last 6 digits of the credit card on the account. I have the attacker’s email address, but not the phone number, so I couldn’t even chat with support. They have an “email support” form, but it asks for the same info. I put in what I knew, but I haven’t heard back from support since the attacker took my account this afternoon, and I fear I’m not going to get it back.