Uber’s 2016 Data Breach Cover-Up and the CSO Sentence

The breach was not made public until November 2017, about a year after it happened.

By Siddharth ShankarUpdated October 23, 2026

Most breach stories are about the attack. This one is about what happened after it. The U.S. Department of Justice’s Northern District of California office described a case where a company’s top security officer was held responsible for hiding a breach.

What the U.S. Attorney’s Office said

Joseph Sullivan, Uber’s former chief security officer, received three years of probation and a $50,000 fine. Judge William H. Orrick imposed the sentence, and the office announced it on May 5, 2023. A jury had found Sullivan guilty of two felonies in October 2022.

The 2016 breach

According to the announcement, hackers exploited the same vulnerability that had been used in a 2014 breach. The stolen data included records associated with about 57 million Uber users and drivers. The release does not specify which types of data were stolen, so this guide does not list them.

How the concealment worked

The office said Sullivan learned of the 2016 breach ten days after he had testified under oath to the Federal Trade Commission about Uber’s security. The FTC was already investigating Uber over the 2014 breach. Instead of reporting the new incident, Sullivan arranged payments to the hackers in exchange for non-disclosure agreements. Those agreements falsely stated that the hackers had not taken or stored any data.

Uber had reached a preliminary settlement with the FTC in the summer of 2016 without disclosing the later breach. The office says Sullivan learned the FTC was relying on false information from Uber and did not alert Uber’s lawyers or the FTC. In fall 2017 he made false statements to Uber’s new chief executive and to outside lawyers investigating the incident.

How it came to light

Uber’s new management uncovered the facts. It disclosed the 2016 breach publicly and to the FTC in November 2017, roughly a year after the attack.

Why a delay matters to you

When a company waits, the people whose data was taken do not get the chance to protect themselves. A password reset or a closer look at account activity is much more useful in the first days than a year later. That is why breach-notification laws and regulators focus on timing. It is also why you should not assume that no news means no breach.

What to do if you used a service that was breached

1. Change the password you used on the service, and on any other site where you reused it.
2. Turn on two-factor authentication wherever it is offered.
3. Check your email address against breach lookups. Our guide on how to check if your email has been exposed shows how.
4. Watch for phishing. Criminals send fake “security alert” messages after real incidents. See how to tell if a breach notice is real or phishing.
5. Judge the risk. Older incidents can still matter. Read should you worry about an old data breach.

What the case shows about accountability

Companies are expected to tell regulators and customers about serious breaches, and executives can face personal consequences if they hide them. For other cases where fines or sanctions followed poor handling, see the Capital One breach and the British Airways fine.

Reading breach news carefully

Details change as investigations continue. Where a figure comes from an official release, as here, it is worth citing the release. Where an official release is silent, such as on the data types in this case, it is better to say so than to guess. Our data breach statistics page collects figures from official reports.