A federal judge ruled that a former security chief for Uber Technologies Inc. must face wire fraud charges for his alleged part in attempting to hide a 2016 hack that resulted in the exposure of the personal data of 57 million users and drivers.
In a December addition to an earlier indictment, the U.S. Department of Justice added the three charges against Joseph Sullivan, alleging that he had made arrangements to pay two hackers in exchange for their silence while attempting to hide the hacking from passengers, drivers, and the U.S. Federal Trade Commission.
Judge William Orrick of the U.S. District Court in San Francisco dismissed Sullivan’s argument that the prosecution had not made enough allegations that he had concealed the hacking in order to keep Uber drivers from leaving and continuing to pay service fees.
Additionally, Travis Kalanick, the company’s former CEO, and its general counsel were reportedly duped, not its drivers, as claimed by Sullivan, according to Orrick.
The accused, who was initially charged in September 2020, is thought to be the first corporate information security officer to be charged criminally with attempting to hide a breach.
According to the prosecution, Sullivan arranged for the hackers to receive $100,000 in bitcoin and to sign nondisclosure agreements that falsely claimed they had not stolen any data.
Uber had a bug bounty program that was not meant to cover up data thefts but to reward security researchers who disclose bugs.
After becoming aware of the severity of the breach, Uber’s current CEO, Dara Khosrowshahi, fired Sullivan.
In order to resolve complaints from all 50 U.S. states and Washington, D.C. that it took too long to disclose the hacking, the San Francisco-based business paid $148 million in September 2018.
