Uber 2016 data breach and cover-up

On 21 November 2017, more than a year after the fact, Uber disclosed that attackers had stolen the personal data of 57 million riders and drivers in October 2016 — and that the company had paid the hackers $100,000 to keep quiet rather than report the breach. The incident became the defining case study in corporate breach cover-ups and the first U.S. prosecution of an executive for concealing one.

What happened

In October 2016, two attackers — later identified as Brandon Glover and Vasile Mereacre — gained access to a private Uber GitHub repository used by the company's engineers. Inside, they found Amazon Web Services credentials that were valid for Uber's cloud storage. Using those keys, they downloaded a backup archive containing rider and driver records.

The haul included the names, email addresses, and mobile phone numbers of roughly 57 million users worldwide, plus the driver's license numbers of around 600,000 U.S. drivers.

The cover-up

Instead of disclosing the breach to regulators and affected individuals — as required under data-breach notification laws, and while Uber was already under active FTC investigation over an earlier 2014 incident — Uber's security leadership chose concealment.

Chief Security Officer Joe Sullivan and his team paid the attackers $100,000 in bitcoin and had them sign non-disclosure agreements falsely attesting that no data had been taken. The payment was routed through Uber's HackerOne bug-bounty program to make it look like a routine security reward, even though the typical bounty ceiling at the time was a fraction of that sum.

The breach stayed hidden until new CEO Dara Khosrowshahi learned of it and went public in November 2017.

Impact

• 57 million rider and driver records exposed, including 600,000 driver's license numbers.
• A $148 million settlement in September 2018 with the attorneys general of all 50 U.S. states and the District of Columbia — at the time the largest multistate data-breach settlement on record.
• An expanded FTC consent order requiring 20 years of privacy audits.
• The two extortionists, Glover and Mereacre, pleaded guilty to federal computer-fraud charges in 2019.
• CSO Joe Sullivan was criminally convicted in 2022 of obstructing the FTC and misprision of a felony, and sentenced to three years' probation plus a $50,000 fine — the first time a corporate security executive faced criminal liability for a breach cover-up.

Why it matters

The Uber case redrew the line between a security incident and a crime. The breach itself was unremarkable — leaked cloud credentials in a code repository, a pattern repeated across the industry. What made it historic was the decision to conceal it and dress up an extortion payment as a bug bounty. Sullivan's conviction sent an unambiguous message to every CISO: the duty to disclose is a legal obligation, not a discretionary call, and an executive who buries a breach can be held personally and criminally accountable.