Former Uber security chief charged for allegedly covering up hack - CNET

The Department of Justice has indicted Uber's former head of security for allegedly covering up a data breach that affected more than 50 million people. While Uber and its then-chief security officer learned about the hack in 2016, the company didn't publicly disclose it until a year later, prosecutors said. 

Officials said the alleged cover-up came directly from Joe Sullivan, who served as Uber's security chief from April 2015 to November 2017. In October 2016, Uber suffered a data breach. Two hackers, Brandon Charles Glover and Vasile Mereacre, were convicted in October 2019, and were also behind cyberattacks against the online learning website Lynda. 

The hackers stole data on 57 million drivers and riders -- including names, email addresses and driver's license numbers -- and agreed to delete it for a price.    

Rather than publicly disclosing the hack, which companies are required to do within a certain number of days in states like California, Uber paid the hackers $100,000 and had them sign a nondisclosure agreement. 

Sullivan described the payment as a bug bounty reward, which companies often pay out to researchers who discover security flaws. Prosecutors said the payment was more of a cover-up than a bounty reward. 

"While this case is an extreme example of a prolonged attempt to subvert law enforcement, we hope companies stand up and take notice," FBI deputy special agent in charge Craig Fair said in a statement. "Do not help criminal hackers cover their tracks. Do not make the problem worse for your customers, and do not cover up criminal attempts to steal people's personal data."   

The hack only became public knowledge after a full year, when former Uber CEO Travis Kalanick was forced out and replaced by Dara Khosrowshahi. Sullivan had briefed the new CEO about the cyberattack, but edited out details about what data the hackers obtained and when the company paid the hackers. 

The company fired Sullivan after the public disclosure, and paid $148 million in a settlement over the data breach. 

Sullivan has been charged with obstruction of justice, and faces a maximum of five years in prison.  

"We continue to cooperate fully with the Department of Justice's investigation. Our decision in 2017 to disclose the incident was not only the right thing to do, it embodies the principles by which we are running our business today: transparency, integrity, and accountability." Uber said in a statement. 

In private conversations, Sullivan told Uber's security team it needed to "make sure word of the breach did not get out," according to court documents. The data breach also remained hidden from the Federal Trade Commission, which was already investigating Uber over a data breach in 2014.