MyRecon OSINT

← Case Files · The Breach Files

2016 · Ride-hailing

Uber, 2016: the breach that was paid to disappear

Case file · 4 min read · Published 14 September 2026

People affected
57 million riders and drivers; 600,000 driver's licence numbers
When it happened
October 2016
Made public
21 November 2017
How they got in
Credentials found in a private code repository, used to reach cloud storage
Attributed to
Two individuals who later pleaded guilty in the United States
What it cost
$148 million multistate settlement; the chief security officer criminally convicted

What was exposed: Names · Email addresses · Phone numbers · 600,000 US driver's licence numbers

By the standards of this archive, Uber's 2016 breach is small. Fifty-seven million names, email addresses and phone numbers, plus 600,000 driver's licence numbers — serious, but not remarkable. It is here because of what happened afterwards, which ended with a chief security officer being convicted in a federal court for the way a breach was handled.

How the data was taken

The technical story is short and depressingly common. Uber engineers used a private code repository. Credentials for the company's cloud storage were present in that repository. Attackers obtained access to the repository, found the keys, and used them to reach a storage account containing rider and driver records.

Keys in source control is a failure that predates cloud computing and has survived every attempt to design it out. The reason it persists is that it is convenient at exactly the moment an engineer is trying to make something work, and invisible thereafter. The modern answer — short-lived credentials issued to a workload rather than long-lived keys held by a person, plus automated secret scanning on every commit — exists largely because of cases like this one.

What made it a criminal matter

In October 2016, the attackers contacted Uber and asked for money. Uber paid $100,000. It routed the payment through its HackerOne bug bounty programme and had the two individuals sign non-disclosure agreements stating that they had not taken any data.

The context that turned this from bad judgement into a prosecution. At the time, Uber was already answering questions from the Federal Trade Commission about an earlier 2014 breach. The company was, in other words, in the middle of a regulatory proceeding about its data security when it learned of a much larger incident, paid to keep it quiet, and did not tell the regulator. That sequence is what the obstruction charge was built on.

Riders and drivers were not notified. Regulators were not notified. The record shows the payment was recorded as a bug bounty, which is a category meant for researchers who report a flaw, not for people holding a copy of a customer database.

The silence held for just over a year. In November 2017 Dara Khosrowshahi, who had become chief executive that August, published the incident and dismissed two members of the security team, including chief security officer Joe Sullivan.

The timeline

  1. 2014 — An earlier Uber breach leads to an FTC investigation.
  2. October 2016 — Attackers obtain repository access, find cloud credentials, and copy 57 million records. They contact Uber demanding payment.
  3. November 2016 — Uber pays $100,000 through its bug bounty programme; the attackers sign non-disclosure agreements.
  4. August 2017 — Dara Khosrowshahi becomes chief executive.
  5. 21 November 2017 — Uber discloses the breach and the payment. Joe Sullivan and a colleague are dismissed.
  6. September 2018 — A $148 million settlement with 50 US states and the District of Columbia, the largest multistate data breach settlement at the time.
  7. November 2018 — The UK Information Commissioner's Office fines Uber £385,000; the Dutch regulator adds €600,000.
  8. 2019 — The two attackers plead guilty in US federal court.
  9. October 2022 — Sullivan is convicted of obstruction and misprision of a felony. May 2023 — sentenced to three years' probation.

What it changed

Security executives acquired personal legal exposure. Before Sullivan's conviction, the worst realistic outcome for a security leader who mishandled a breach was dismissal. Afterwards, general counsel across the industry rewrote incident response plans to make the disclosure decision a documented, collective, legally supervised one — not because the law changed, but because a prosecution had demonstrated where the line sits.

Bug bounty programmes had to define their boundaries. Platforms and companies tightened the rules: a bounty is for a vulnerability report, and any case involving exfiltrated data is an incident, not a submission. Several programmes added explicit language after this case.

Disclosure timing hardened into law. Uber sits alongside Yahoo as the case study cited when regulators argue for mandatory notification deadlines. The 72-hour rule in the GDPR, the four-business-day materiality rule in the SEC's 2023 cyber disclosure regime, and equivalent regimes elsewhere all exist in a world shaped by companies that chose silence and were later found out.

The uncomfortable part

It is worth being fair about the decision Sullivan faced, because the industry's reaction to the conviction was not unanimous. Extortion payments were, in 2016, a genuinely grey area, and framing one as a bounty was not unheard of. The elements that made this prosecution possible were specific: an active federal investigation into the company's data security, non-disclosure agreements containing a false statement about whether data was taken, and a year of silence towards the people in the file.

The practical lesson for anyone running security is not "never negotiate". It is that the decision to withhold notification is a legal decision with personal consequences, and it must be made by the company in writing, not by one executive under pressure.

If you used Uber before 2017

  1. The exposed fields are contact details, so expect targeting rather than fraud. A phone number tied to a real name and a known service is exactly what a smishing campaign needs.
  2. Drivers should watch identity documents. 600,000 driver's licence numbers were in the set; a licence number supports impersonation in ways a phone number does not.
  3. Re-check which apps hold your identity documents today, and remove what is no longer needed — see how to audit that footprint.

Checked against every breach on record, against public breach data only. Your address is not sent to us as a form and is not stored — it is handed straight to the lookup tool in your own browser. See the privacy policy.

Questions people ask

What did Uber actually do wrong?

Two separate things. The breach itself was a credential-handling failure: access keys in a private code repository that reached a cloud storage account. The far more serious conduct was the response — paying the attackers $100,000 through the bug bounty programme, having them sign non-disclosure agreements describing the theft as research, and not notifying users, drivers or regulators for more than a year, while the company was already under investigation for an earlier breach.

Was the chief security officer really convicted?

Yes. Joe Sullivan was convicted in October 2022 of obstructing a Federal Trade Commission proceeding and misprision of a felony, and sentenced in 2023 to three years of probation. It is the case that established personal criminal exposure for a security executive over the handling of a breach, rather than the breach itself.

Is paying a bug bounty for stolen data legitimate?

Paying a researcher who finds a flaw is normal and valuable. Paying people who have already taken customer data, in exchange for silence and a signed agreement, is something else — and prosecutors treated the bounty framing as concealment rather than disclosure. The distinction is whether data was exfiltrated and whether the people affected were told.

What data was taken?

Names, email addresses and mobile numbers for around 57 million riders and drivers, plus roughly 600,000 US driver's licence numbers belonging to drivers. No trip history, card numbers or dates of birth were reported as taken.

Sources

Read next

Case files are written from the public record: regulatory findings, court filings, company disclosures and contemporaneous reporting, cited above. Figures are the ones the organisation or its regulator finally settled on, which is often not the number first reported — where that differs, the page says so. Disputed accounts are marked as disputed rather than resolved in either direction.

← All case files Breach archive →