In 2016 hackers breached Uber and exfiltrated PII of 57 million drivers and riders. Uber did not publicly disclose the incident or inform the F.T.C., which was already examining the company’s data security after a 2014 breach, but rather had the hackers sign an NDA. Joe Sullivan, the former Uber security chief, was found guilty by jury in federal court. The New York Times provides some additional details. The jury convicted him of obstruction of justice and concealing a felony, and prosecutors said he arranged a $100,000 bitcoin payment to the hackers.
The case could change how security professionals handle data breaches. However, Sullivan tried to hide the breach from the government regulators. As such, there will probably be no major change in policy. Not every CISO is that relaxed: Rick Holland of Digital Shadows warned of “CISO scapegoating”, and Sounil Yu of JupiterOne pointed out that Sullivan acted “with the blessing of executive management”.