Former Uber Security Chief Found Guilty of Data Breach Coverup

A U.S. federal court docket jury has discovered previous Uber Main Security Officer Joseph Sullivan responsible of not disclosing a 2016 breach of shopper and driver documents to regulators and trying to include up the incident.

Sullivan has been convicted on two counts: One for obstructing justice by not reporting the incident and one more for misprision. He faces a greatest of five yrs in jail for the obstruction cost, and a most of a few a long time for the latter.

“Technology firms in the Northern District of California obtain and retailer large quantities of information from end users,” U.S. Lawyer Stephanie M. Hinds reported in a push statement.

“We count on those companies to guard that data and to warn clients and correct authorities when these information is stolen by hackers. Sullivan affirmatively worked to hide the data breach from the Federal Trade Commission and took methods to reduce the hackers from being caught.”

The 2016 hack of Uber occurred as a outcome of two hackers getting unauthorized access to the firm’s database backups, prompting the ride-hailing organization to secretly spend a $100,000 ransom in December 2016 in trade for deleting the stolen information and facts.

Uber also experienced the extortionists indicator a non-disclosure settlement in an try to move-off the crack-in as a bug bounty reward. The backups contained information belonging to 50 million Uber riders and 7 million motorists.

Complicating items additional, the incident occurred when the U.S. Justice Division and the Federal Trade Fee (FTC) were currently probing the business for a further data breach that took put on Could 13, 2014.

In February 2015, Uber unveiled that one of its databases experienced been improperly accessed pursuing a opportunity compromise of a single of the encryption keys, ensuing in the exposure of names and license figures of about 50,000 drivers. The incident was found on September 14, 2016.

“After deceptive customers about its privacy and security practices, Uber compounded its misconduct by failing to inform the Fee that it experienced another information breach in 2016 whilst the Fee was investigating the firm’s strikingly equivalent 2014 breach,” the FTC mentioned in 2018.

The DoJ explained that Sullivan performed a vital job in shaping Uber’s response to FTC concerning the 2014 breach, with the defendant testifying below oath on November 4, 2016, about the selection of techniques that he claimed the organization had taken to safe consumer information.

But upon studying that Uber was compromised once more, that much too just ten times after his FTC testimony, the agency claimed “Sullivan executed a plan to prevent any expertise of the breach from achieving the FTC” instead of opting to disclose the make any difference to the authorities and its buyers.

Federal prosecutors also accused Sullivan of lying to Uber’s main govt Dara Khosrowshahi as perfectly as the firm’s exterior attorneys investigating the 2016 incident, stating the “truth about the breach” at last came to light in November 2017.

What’s extra, Travis Kalanick, Uber’s co-founder and then CEO, who resigned from the organization in June 2017, is said to have accredited Sullivan’s technique for managing the unauthorized intrusion. Kalanick has not been billed.

In a assertion shared with The New York Occasions, Sullivan’s lawful staff reported his only focus in the course of the course of the incident and his qualified career has been to guarantee the “security of people’s individual info on the internet.”

The development, which marks the first time a senior organization government has confronted criminal rates over a information breach, comes as the two hackers involved in the 2016 incident await sentencing for their fraud conspiracy costs immediately after pleading to the criminal offense in October 2019.

“The separate guilty pleas entered by the hackers demonstrate that soon after Sullivan assisted in masking up the hack of Uber, the hackers have been in a position to dedicate an supplemental intrusion at another company entity — Lynda.com — and endeavor to ransom that data as effectively,” the DoJ pointed out.

The reality that the 2014 and 2016 security lapses mirrored each and every other notwithstanding, Uber arrived beneath highlight very last month for the erroneous explanations when its programs have been breached a third time in a hack that it has due to the fact connected to the LAPSUS$ cybercrime group.

This earlier July, Uber also settled with the DoJ to spend $148 million and agreed to “implement a corporate integrity plan, unique knowledge security safeguards, and incident response and knowledge breach notification plans, alongside with biennial assessments.”

“The concept in today’s responsible verdict is distinct: businesses storing their customers’ info have a accountability to safeguard that data and do the ideal point when breaches arise,” FBI San Francisco Special Agent in Demand Robert K. Tripp said.

Identified this posting exciting? Follow THN on Fb, Twitter  and LinkedIn to go through a lot more exclusive written content we put up.

Some sections of this post are sourced from:
thehackernews.com