Former Uber CSO Joseph Sullivan was accused of obstructing justice after covering up a massive data breach. Sullivan paid hackers $ 100.000 in bitcoin to hide stolen information belonging to more than 57 million Uber users and drivers.
The case
Former Uber Chief Security Officer (CSO) Joseph Sullivan was accused of paying $ 100.000 in bitcoin to cover a massive data breach. According to a Forbes report dated August 20, Sullivan attempted to hide a hack in 2016 that compromised the data of millions of Uber users and drivers.
A Department of Justice (DoJ) criminal complaint accused Sullivan of obstructing justice with the cover-up attempt. The DoJ press release outlined how Sullivan allegedly took deliberate steps to prevent news of the data breach from reaching the Federal Trade Commission (FTC). Sullivan initially attempted to repay the hackers by funneling money through a bug bounty program.
Between April 2015 and November 2017, during Sullivan's tenure as Uber's CSO, two hackers contacted him via email and demanded a six-figure payment in exchange for their silence.
The hackers managed to download Uber's database containing the personal information of some 57 million users and drivers, including driver's license numbers. The report claims that Uber paid hackers $ 100.000 in bitcoin in December 2016 and attempted to get anonymous hackers to sign nondisclosure agreements.
The agreements contained a false representation of the situation where it was said that the hackers had not taken or stored any data. An Uber spokesperson told Forbes, “We continue to cooperate fully with the Department of Justice investigation. Our decision in 2017 to disclose the news of the accident was not only the right thing to do, but embodies the principles under which we run our business today: transparency, integrity and accountability. "
Hackers identified and convicted
The two hackers identified by Uber were prosecuted in the Northern District of California. Both pleaded guilty on October 30, 2019, on cyber fraud conspiracy charges and are now awaiting sentencing.
The criminal complaint clarifies that "both [the hackers] chose to successfully target and hack other tech companies and their users' data" after Sullivan decided not to bring the Uber data hack to the attention of the forces. of the order.
In summary, Sullivan was charged with obstructing justice and misjudging a crime. Sullivan's first federal court appearance has not yet been scheduled.
Uber is a publicly traded company with a market capitalization of $ 54,03 billion. The Uber shares they are priced at 26,14 euros at the time of going to press.
