Uber 2016 Cover-Up: Paying Hackers $100,000 via Bug Bounty to Hide a Breach
Uber discovered a breach affecting 57 million riders and drivers in 2016, then paid the hackers $100,000 via its bug bounty programme as hush money and concealed the breach from regulators and the public for a year.
Background
In 2016, Uber was under investigation by the FTC over a 2014 data breach. When a second, larger breach occurred in October 2016, instead of disclosing it, new CSO Joe Sullivan and others decided to pay the hackers and suppress the information — particularly from regulators.
The Attack
Two hackers discovered that Uber engineers had accidentally posted credentials for Uber's AWS S3 storage to a private GitHub repository. The hackers used those credentials to download 57 million rider and 600,000 driver records (names, emails, phone numbers, and for drivers, licence numbers). They contacted Uber demanding payment. CSO Joe Sullivan's team paid the hackers $100,000 through Uber's HackerOne bug bounty programme (falsely classifying it as a legitimate bounty), obtained a non-disclosure agreement, and did not disclose the breach. The breach was not disclosed for 13 months.
Response
New CEO Dara Khosrowshahi discovered the cover-up shortly after joining in November 2017 and disclosed the breach publicly in November 2017. Joe Sullivan was fired and later prosecuted. Uber settled with the FTC for $148 million. The state AGs settlement required Uber to implement a comprehensive privacy programme.
Outcome
Joe Sullivan became the first CISO ever convicted of a crime related to an employer's data breach (October 2022). He was sentenced to three years of probation. The case established that actively concealing a breach from regulators is a federal crime. The case sent a chilling signal to the security industry about personal criminal liability for breach cover-ups.
Key Takeaways
- Bug bounty programmes must have clear criteria — paying extortion through a bounty programme is fraud and obstruction
- CISOs have personal legal liability for breach cover-ups — comply with disclosure obligations regardless of corporate pressure
- Credentials in GitHub repositories — even private ones — should be treated as compromised immediately and rotated
- The FTC investigation was ongoing during the cover-up — concealing a breach from an active regulator is a serious federal offence