Updated October 2026: This post has been expanded from its original December 2018 version with the full story of how the 2016 Uber breach happened, how it was hidden, the fines and settlements that followed, the criminal case against the company's former security chief, and lessons that still apply. It is a historical account; details describe the time it covers, not today.
In late November 2018, data protection regulators in the United Kingdom and the Netherlands fined Uber over a data breach the company had suffered two years earlier. The penalties were modest in size, £385,000 from the UK's Information Commissioner's Office (ICO) and €600,000 from the Dutch Data Protection Authority. What made the case notable was not the hack itself, but what Uber did afterward: it paid the attackers and kept the breach secret for about a year.
The cover-up turned an ordinary security failure into one of the most closely studied incidents in corporate security. It led to a record U.S. settlement and, eventually, the criminal conviction of Uber's former chief security officer. This post walks through what happened, the consequences, and the practical lessons for both individuals and companies.
How the breach happened
The attack in 2016 did not rely on sophisticated malware. It started with reused passwords.
- Stolen credentials. The attackers used usernames and passwords belonging to Uber employees that had been exposed in earlier, unrelated breaches at other companies. This technique is known as credential stuffing, and it works when people reuse the same password across services.
- A private code repository. With those credentials, the attackers logged into a private GitHub repository used by Uber engineers.
- A key left in the code. According to the Federal Trade Commission, an Uber engineer had placed an access key for the company's cloud storage in that code. The attackers used it to reach data Uber stored on Amazon Web Services.
- The data. They downloaded files containing personal information on about 57 million riders and drivers worldwide.
The FTC later broke down what was in the unencrypted files Uber stored in the cloud:
The cover-up
In November 2016, the attackers emailed Uber's chief security officer, Joseph Sullivan, said they had stolen a large amount of data, and demanded payment. At the time, Uber was already under FTC investigation over an earlier breach in 2014, in which names and driver's license numbers of about 50,000 people had been accessed. Sullivan had joined Uber in April 2015, during that investigation.
According to the U.S. Department of Justice, Sullivan did not report the new breach to the FTC, to other authorities or to the affected users. Instead, in December 2016, Uber paid the attackers $100,000 in bitcoin through its bug bounty program, which normally rewards researchers for responsibly reporting security flaws. The attackers signed nondisclosure agreements that falsely stated they had not taken or stored any data.
Uber did not disclose the breach publicly, or to the FTC, until November 2017, about a year after it learned of it. The disclosure came after a change in leadership, and new CEO Dara Khosrowshahi publicly apologized. The FTC's acting chairman later said Uber had "compounded its misconduct" by not telling the agency about the second breach while it was investigating the first.
The penalties
Regulators in several countries took action. The European fines were limited because the breach happened before the EU's General Data Protection Regulation took effect in May 2018, so the older, lower penalty limits applied.
| Regulator | Date | Action |
|---|---|---|
| U.S. Federal Trade Commission | April 2018 | Expanded settlement: Uber must report future breaches and submit all privacy audits |
| U.S. state attorneys general | September 2018 | $148 million multistate settlement, the largest of its kind at the time |
| UK Information Commissioner's Office | November 2018 | £385,000 fine |
| Dutch Data Protection Authority | November 2018 | €600,000 fine; about 174,000 Dutch people affected |
Sources: FTC; Wikipedia summary of Uber settlements; Dutch Data Protection Authority.
The Dutch regulator's finding was specific: Uber had failed to notify the authority and the affected people within 72 hours of discovering the breach, as Dutch rules required. The FTC's revised settlement went further than its original 2017 proposal. It required Uber to notify the agency of future incidents involving consumer data, to submit every third-party privacy audit rather than only the first, and to keep records of bug bounty reports about vulnerabilities that could expose consumer data.
What happened next: a criminal conviction
The case did not end with fines. In 2020, federal prosecutors charged Sullivan in connection with concealing the breach. The two hackers had already pleaded guilty, in October 2019, to computer fraud conspiracy charges.
On October 5, 2022, a federal jury in San Francisco convicted Sullivan of two felonies: obstructing proceedings of the Federal Trade Commission, and misprision of a felony, which means actively concealing a felony from authorities. Prosecutors said he had told a subordinate that they "can't let this get out," kept it from the Uber lawyers handling the FTC inquiry, and later misled Uber's new CEO and outside investigators.
In May 2023, U.S. District Judge William H. Orrick sentenced Sullivan to three years of probation and a $50,000 fine. The conviction was widely discussed in the security industry, because it was among the first times a corporate security executive was criminally convicted over how a breach was handled rather than for causing it.
- 2014
Earlier breach exposes data of about 50,000 people; FTC investigates - November 2016
Attackers contact Uber after stealing data on about 57 million users - December 2016
Uber pays $100,000 through its bug bounty program; attackers sign NDAs - November 2017
Uber discloses the breach publicly - April 2018
FTC announces expanded settlement - September 2018
$148 million multistate settlement - November 2018
UK and Dutch regulators fine Uber - October 2019
The two hackers plead guilty - October 5, 2022
Former security chief convicted on two felony counts - May 2023
Sentenced to three years of probation and a $50,000 fine
Lessons that still apply
For individuals
- Use a different password for every account. The entire Uber breach began with passwords leaked elsewhere and reused. A password manager, including the free ones built into major browsers and phones, makes this practical.
- Turn on multi-factor authentication wherever it is offered, especially for email, work and cloud accounts. Passkeys, now supported by most major services, remove the reused-password problem entirely.
- Take breach notices seriously. If a company tells you your data was exposed, change the password for that service and anywhere else you used it.
For companies and developers
- Never store keys or passwords in source code. Use a secrets manager, and turn on the secret-scanning tools that major code hosting platforms provide to catch credentials before they are committed.
- Require multi-factor authentication for code repositories and cloud consoles. Stolen passwords alone should never be enough.
- Encrypt sensitive data at rest, so that a single leaked key does not expose readable personal information.
- Know your notification deadlines. Under the GDPR, organizations generally must notify regulators of a qualifying breach within 72 hours of becoming aware of it, and many U.S. states have their own notification laws.
- Keep bug bounties for what they are for. A bounty rewards responsible disclosure. Using one to pay off attackers and hide a breach is what turned Uber's incident into a criminal case.
The bottom line
The 2016 Uber breach began with reused passwords and a key left in code, problems that are still common. The fines that followed were small by today's standards, but the decision to hide the breach cost the company far more in settlements and credibility, and led to a criminal conviction for its security chief. The lesson for any organization is clear: disclose quickly and honestly, because concealment is the part regulators and prosecutors punish most.
Sources
- U.S. Department of Justice: Former Uber chief security officer convicted (October 2022)
- U.S. Department of Justice: Former Uber chief security officer sentenced (May 2023)
- Federal Trade Commission: Uber agrees to expanded settlement (April 2018)
- Dutch Data Protection Authority: Fine for data breach Uber
- Wikipedia: Uber (2016 data breach and settlements)
Top image: "Smartphone mounted on car dashboard during a drive in a modern vehicle with a focus on navigation use" by Shixart1985, CC BY 2.0, via Wikimedia Commons (resized). Charts by Thank You Robot.
0 Comments