In 2022, the group was involved in several cybersecurity crimes leading to the publication of victims' data, including:

• leaking source code and employee credentials from Nvidia,[1] including the release of code-signing certificates[7]
• a breach of Microsoft,[8][9] and the release of 37 GB of source code from an Azure dev ops server. This was claimed to include 90% of the source code for the Bing search engine[10][11]
• a breach of Mercado Libre, an E-commerce company[12]
• a release of the source code of Samsung Galaxy phones and Samsung company data[13]
• a cybersecurity incident within the gaming company Ubisoft[14]
• a breach in the identity and access management company Okta[15][16]
• a breach and 70GB dump from Globant[17]
• a breach of T-Mobile's systems[18]

The group used the messaging app Telegram, and the Lapsus$ Telegram channel was used to announce data dumps and to recruit accomplices. As of March 2022, it has nearly 50,000 subscribers.[3] The group posted polls as to which organisation the group should target next.[19]

The FBI made an appeal for information on 21 March 2022.[20]

The group's assumed modus operandi was based on obtaining access to a victim organisation's corporate network by acquiring credentials from privileged employees. These credentials were acquired in a number of ways, including recruitment[21] or hacking privileged employees using methods such as SIM swapping.[3] Lapsus$ then used remote desktop or network access to obtain sensitive data, such as customer account details or source code. The group then extorted the victim organisation with threats of disclosing the data.[10] In the conspicuous cases, the data was then subsequently released, and information posted on Telegram.

A Bloomberg report stated that the group's mastermind was a 16-year-old residing in Oxford, England, and another core member is a teenager in Brazil. The report also stated that the group has seven members and was likely formed recently.[22][23]

On 24 March 2022, seven people aged between 16 and 21 were arrested by the City of London Police in connection to a police investigation into Lapsus$. An alleged prominent member of the group with the pseudonym White was arrested in Oxford, England. His identity had allegedly previously been disclosed by a former associate, and various groups including research group Unit 221B were reported to have identified him.[24] Two teenage members were charged on 1 April 2022.[25]