In late 2016, Uber was breached by two hackers who found an AWS S3 bucket containing credentials for Uber's GitHub repositories, used those credentials to access a private GitHub repository, found hardcoded AWS access keys in that repository, and used those keys to download a file containing personal data for 57 million Uber users and 600,000 Uber drivers. The breach was serious but not extraordinary by the standards of the era. What made it a landmark case in data breach history was what Uber did next: it paid the hackers $100,000 through its bug bounty program as a cover-up payment and concealed the breach from regulators and the public for over a year.

The cover-up was orchestrated by Uber's Chief Security Officer Joe Sullivan, with the involvement of then-CEO Travis Kalanick. The decision to disguise a ransom payment as a legitimate bug bounty - and to classify the stolen data as permanently destroyed rather than report the breach to regulators - led to criminal charges. Sullivan was convicted in October 2022 of obstruction of justice and concealment of a felony. The case established legal precedent around corporate security executive liability and was the first criminal conviction of a CSO for breach concealment.

The Breach: A Classic Credential Chain

The 2016 Uber breach followed a technical path that has become frustratingly common: credentials in a code repository provided access to cloud infrastructure containing sensitive data. The attackers - Brandon Charles Glover and Vasile Mereacre - found an Uber GitHub repository credential exposed online, used it to access Uber's private GitHub repositories, and discovered AWS access keys stored in the code. Using those keys, they accessed an S3 bucket containing a data archive with 57 million user records and 600,000 driver records.

The driver records were particularly sensitive: they included driver's license numbers for 600,000 drivers in the US. The user records included names, email addresses, and phone numbers for 57 million riders globally. No payment card numbers or bank account information was in the stolen file - those were stored in separate, more protected systems. But the driver's license numbers for 600,000 individuals represented a significant identity theft risk.

The attackers contacted Uber and demanded payment in exchange for deleting the data and staying silent. This was extortion, not a good-faith bug report. Uber's security team, led by Joe Sullivan, decided to treat the payment as a bug bounty rather than a ransom - and required the attackers to sign a nondisclosure agreement claiming they had not retained any copies of the data.

[TECHNICAL NOTE]
The technical vulnerability chain in the 2016 Uber breach was a multi-step credential exposure failure. Step 1: Uber engineers pushed code containing GitHub access tokens to a private repository. The tokens were likely included accidentally, as happens when developers use tokens for testing and commit them before removing them. Step 2: the GitHub repository credentials were found by the attackers - either through a public exposure, through credential stuffing of GitHub accounts, or through a separate compromise. Uber's private repositories were accessible to anyone with valid credentials. Step 3: the private repository contained hardcoded AWS access key/secret pairs. Hardcoding cloud credentials in source code is a well-documented security failure; git-secrets, GitHub's own secret scanning, and similar tools exist specifically to prevent this. Step 4: the AWS credentials provided access to S3 storage containing a backup data file. The file was not encrypted at rest in a way that would be inaccessible to anyone with S3 access. The entire chain - GitHub credential to repository access to hardcoded AWS keys to S3 data - represents a failure at each step that could have been independently prevented. Each step is a known risk with known mitigations. The breach was not a sophisticated zero-day attack; it was a systematic failure to apply basic credential hygiene.

The Cover-Up

After being contacted by the hackers, Uber's security team made a series of deliberate decisions to conceal the breach. They used Uber's HackerOne bug bounty account to make the $100,000 payment - structuring it to look like a legitimate bounty payment for finding a vulnerability, rather than an extortion payment for stolen data. The NDA the attackers signed included false statements that they had not retained the data and that no users' information had been affected.

The decision to pay and conceal was made at a time when Uber was under intense regulatory scrutiny (for separate antitrust and labor practices issues) and approaching a major fundraising round. A public breach disclosure of this scale would have been significantly damaging. Sullivan and others made the calculation that concealment was preferable to disclosure.

The breach was eventually disclosed in November 2017, when new Uber CEO Dara Khosrowshahi, who had replaced Travis Kalanick in August 2017, ordered an internal review that uncovered the incident. By that point, over a year had passed during which affected users and drivers were unaware of the exposure and regulators had been kept in the dark.

[WARNING]
The Joe Sullivan prosecution established new legal territory for security executives. Sullivan was charged with obstruction of justice (for misleading FTC investigators who were asking about Uber's data security in connection with a separate 2014 breach, at a time when Sullivan knew about the 2016 breach and did not disclose it) and misprision of a felony (knowing about the crime - the hackers' extortion - and taking active steps to conceal it). Sullivan argued that his actions were a legitimate business decision and that bug bounty payments for data returns were industry practice. The jury rejected this defense, finding in October 2022 that the payment was made with intent to conceal a crime rather than as a legitimate security response. Sullivan was sentenced to three years of probation and a $50,000 fine in May 2023 - a lenient sentence given the conviction, but the conviction itself was the landmark. The case sent a clear message to security executives: they can face personal criminal liability for breach concealment, not just corporate liability for the company. Compliance with breach notification laws is not optional, and disguising ransom payments as bug bounties does not create legal cover.

Regulatory Consequences and the Attackers

Uber settled with state attorneys general across the US for $148 million in September 2018 - the largest data breach settlement in history at the time. The FTC also penalized Uber separately for the breach. The UK ICO and Dutch DPA (both regulators under what was then the EU's pre-GDPR data protection regime) also imposed fines.

The two attackers - Brandon Glover and Vasile Mereacre - pleaded guilty to federal computer fraud charges. They cooperated with prosecutors, which contributed to Sullivan's prosecution. Both were sentenced to probation.

The case prompted widespread discussion in the security community about the line between bug bounties and extortion, and about the legal and ethical obligations of security executives when facing a breach. HackerOne subsequently issued clearer guidance about what bug bounty programs can and cannot cover - specifically, that they cannot be used to pay for data deletion after unauthorized access, and that extortion should be reported to law enforcement rather than paid.

[IOC]
Uber 2016 breach technical summary: attackers Glover and Mereacre accessed Uber's private GitHub repository via credential discovery; found hardcoded AWS access keys in repository code; used keys to access S3 bucket containing backup data file. Data accessed: 57 million Uber user records (name, email, phone number); 600,000 US driver records (name, driver's license number). No payment card or financial data accessed. Breach occurred: October-November 2016. Extortion demand: $100,000 Bitcoin. Payment mechanism: disguised as bug bounty via HackerOne, with NDA requiring false statement that data was not retained. Breach disclosed: November 21, 2017 (over 1 year after breach). Settlements: $148M to 50 US states/DC AG coalition (September 2018); separate FTC consent order; UK ICO GBP 385,000 fine; Dutch DPA EUR 600,000 fine. Criminal convictions: Joe Sullivan (Uber CSO) - guilty of obstruction of justice and misprision of a felony; sentenced May 2023 to 3 years probation, $50,000 fine. Brandon Glover and Vasile Mereacre - guilty pleas to CFAA violations; sentenced to probation. This remains the first and (as of 2024) most prominent criminal conviction of a corporate security executive for breach concealment.