Uber breach cover-up (2016)

The Uber breach cover-up is the case of a late-2016 data breach the company hid for a year by paying the attackers as if they were bug bounty researchers, and which ended in a criminal conviction for its security chief. In late 2016, attackers obtained credentials to Uber's cloud storage and pulled data on about 57 million riders and drivers, including some 600,000 U.S. driver's license numbers. They asked for money. Uber paid $100,000 through its bug bounty program and told no one. At the time the FTC (Federal Trade Commission) was investigating an earlier breach from 2014. The story broke in November 2017, under new management. What followed was regulatory, then criminal. On September 26, 2018, Uber reached a $148 million settlement with the attorneys general of all fifty states and the District of Columbia over failure to notify, along with security commitments. Joe Sullivan, its former chief security officer, was found guilty by a San Francisco jury in October 2022 of obstructing an FTC proceeding and misprision of felony. On May 4, 2023, Judge William Orrick sentenced him to three years of probation and a $50,000 fine; prosecutors had asked for fifteen months in prison. For a cyber underwriter, the case set three markers. A ransom paid outside the extortion coverage framework, without the insurer's prior consent or a report to law enforcement, cannot be recovered at claim time. Late notification turns a covered breach into a regulatory investigation, and the monetary penalties that follow run into the insurability of fines. And personal liability for the CISO (chief information security officer) now exists in criminal court, which points to the D&O (directors and officers) policy and its intentional misconduct exclusions. The judge called the case a one-off; security chiefs across the market read it as a precedent, and the CISO's employment contract now gets read alongside the D&O policy.