StatewardStateward
← All vulnerabilities
CRITICALSecretscurated

SECRET-UBER-2016

Secrets · Cloud keys · Uber

Summary

In 2016 Uber lost the data of 57 million riders and drivers, and then it lost something arguably worse: the argument that you can quietly pay a breach away. The break-in itself was routine, attackers found Amazon cloud keys hardcoded in one of Uber's private code repositories and used them to download a backup database. What made it infamous was the response. Instead of disclosing the breach, Uber paid the hackers $100,000 to delete the data and keep quiet, dressed up as a bug-bounty reward. When it came out a year later, the cover-up cost Uber a $148 million settlement and made its security chief the first executive criminally convicted over a breach response. It is two lessons in one: keep secrets out of your code, and never cover up a breach.

How it happened

The technical part was ordinary, and Uber had seen it before. Attackers scanned GitHub and found AWS access credentials hardcoded in a private Uber repository. They reached that private repo because Uber engineers were using personal GitHub accounts without enforced MFA and reusing passwords that had been exposed in earlier breaches. With the plaintext AWS key, the intruders authenticated to an Amazon S3 bucket Uber used for backups and, over roughly a month, downloaded the rider and driver datastore, about 57 million people, including some 600,000 driver's license numbers. Uber had already suffered a near-identical breach in 2014 (also an AWS key exposed on GitHub), which the FTC was actively investigating at the time.

Then came the part that made history. Rather than report the breach, Uber, under its chief security officer Joe Sullivan, paid the attackers (Brandon Glover and Vasile Mereacre, who ran the same extortion scheme against LinkedIn's Lynda.com) $100,000 in Bitcoin, in two $50,000 payments, to delete the data and stay silent. Uber disguised the payment as a bug-bounty reward and had the hackers sign non-disclosure agreements that falsely stated no data had been taken. The timing was the damning part: just ten days earlier, Sullivan had given sworn testimony to the FTC about Uber's data-security practices, part of the agency's investigation into that earlier 2014 breach. Concealing a second, identical breach while that inquiry was live is what turned non-disclosure into obstruction. The breach stayed hidden for a full year.

The damage and the cover-up

The data itself, 57 million users and 600,000 driver's licenses, was a serious breach. But the concealment is what defined the case. After it surfaced in November 2017 under a new CEO, Uber paid $148 million to settle with all 50 states and DC, then the largest multistate data-breach settlement ever, for the year-long failure to notify, and accepted an FTC order requiring a 20-year privacy program. Its former CSO Joseph Sullivan was criminally convicted in October 2022 of obstruction and misprision of a felony, the first time a security executive was convicted for mishandling and concealing a breach; he was sentenced to three years' probation, and the Ninth Circuit upheld the conviction in March 2025, settling it as precedent. It became a watershed moment for the personal legal liability of security leaders and for breach-disclosure obligations.

Why Uber 2016 still matters

It carries two lessons. First, hardcoded secrets: an AWS key in a repository is a loaded gun, because git history is permanent, scanners find it fast, and a single key reached a full backup of the company's data, the second time Uber was breached the very same way. Never hardcode credentials; load them from a secrets manager or IAM roles, add pre-commit scanning and push protection, rotate immediately on any leak (deleting the commit does nothing, since it persists in history), and scope keys to least privilege. Second, cover-ups are catastrophic and now personally criminal: concealing a breach compounds the harm and, since the Sullivan conviction was upheld on appeal, can land the security leader in the dock. Disclose promptly and honestly. It is the same hardcoded-credential-in-a-repo pattern that started the Internet Archive breach.

How to fix it

  • Rotate and revoke the leaked AWS key immediately (deleting the commit does not help, since it lives in git history), and scope remaining keys to least privilege.
  • Disclose the breach promptly and honestly to users and regulators; concealment compounds the harm and, since the Sullivan case, the personal legal risk.
  • Scan all repositories for other hardcoded secrets and migrate to a secrets manager or IAM roles.

How to avoid it

  • Never hardcode AWS keys in code; load credentials from a secrets manager or IAM roles at runtime instead of any repository.
  • Add pre-commit secret scanning and enable GitHub push protection to block credential commits before they reach history.
  • Rotate and revoke any leaked AWS key immediately; deleting the commit is not enough since it persists in git history.
  • Scope IAM credentials to least privilege so a leaked key cannot reach backup S3 buckets or full datastores.
  • Enforce SSO and mandatory MFA on source-control accounts, and forbid reusing passwords across services.

References

Related vulnerabilities

All Secrets →