Do repost and rate:
A criminal complaint filed on Thursday with the federal court conveyed charges against former Uber Chief Security Officer (CSO), Joseph Sullivan. As the US Department of Justice (DOJ) reported, Sullivan attempted to conceal an Uber data breach, which occurred four years ago, from the Federal Trade Commission (FTC). He allegedly paid a six-figure amount in Bitcoin to the hackers.
How Sullivan attempted to cover-up Uber data breach in 2016
The 52-year-old Sullivan served at Uber, the popular US transportation network company, between April 2015 and November 2017. While still in office, precisely, on November 14 2016, two hackers contacted him, saying they breached and possessed access to the company’s data. Noteworthily, Uber surface a similar attack in 2014, and Sullivan reported the Uber data breach to the FTC.
Fast forward to 2016, while still rounding up on the 2014 hack, the hackers contacted him on the recent hack. Sullivan allegedly chose to conceal the Uber data breach in 2016 from the FTC, even after confirming that the company’s data was really compromised. The data in question contained personally-identifying information of about 57 million Uber drivers, including the network users.
The hackers demanded a six-figure amount to buy their silence, which Sullivan agreed to do. However, he planned the payment in a deliberate manner to conceal the recent hack from FTC, as alleged in the criminal complaint.
Sullivan took deliberate approaches to conceal Uber data breach
At first, Sullivan connived to pay off the hackers through a bug bounty program. Per the complaint, he paid $100,000 worth of Bitcoin to the hacker, although he didn’t know their true names at that time. Also wanted them to sign a non-disclosure agreement, one that will falsely represent that the hackers didn’t obtain any data. Uber new management was able to learn about the hack in 2016 and reported duly to FTC and the public.
WhileSullivan’s await his initial federal court appearance, the DOJ report summed:
“Sullivan is charged with obstruction of justice, in violation of 18 USC. § 1505; and misprision of a felony, in violation of 18 USC. § 4.”
Tags: Security Hacker
