Uber's security chief got probation for hiding the 2016 breach, and the CEO the judge called just as culpable walked

In October 2016, two hackers slipped into an Uber data store and walked out with the personal records of 57 million people — 50 million riders' names, emails, and phone numbers, and about 7 million drivers' details, including roughly 600,000 U.S. driver's license numbers.¹ Uber's response was not to warn anyone. It was to find the intruders, pay them $100,000 to delete what they'd taken, and dress the transaction up so it looked like a routine bug-bounty reward.² The company then said nothing to regulators or to the people whose data was gone for more than a year.⁹ It is a clean, damning story — and the way it is usually told is wrong in a way that matters.

The popular version is that Uber's security chief was convicted for paying off hackers and hiding a breach. The record says something narrower and stranger. Joe Sullivan was not convicted for the $100,000 payment — the counts built on that were dropped before the jury ever heard them. He was convicted for what he did to one specific reader of that story: a federal investigator who had him under oath ten days before the second hack even surfaced.³ The crime wasn't the payoff. It was lying to the government about a fire while the government was already asking about smoke.

The clock that turned a bad decision into a felony: an FTC investigator was already at the door when the second breach arrived

Here is the timing that makes this case unlike any ordinary cover-up. The Federal Trade Commission was not sniffing around after the 2016 breach; it was already investigating an earlier 2014 Uber breach, and Sullivan — hired soon after that probe opened — had testified to the FTC under oath on November 4, 2016.⁵ Ten days later, he learned Uber had been hacked again, through the same kind of vulnerability that caused the 2014 incident.⁵ That ten-day gap is the whole case. A company can make a terrible, even craven, business call about a breach and commit no federal crime. But when an agent of the state has you on the record about your security, and you then withhold the very thing they're investigating, the ordinary bad judgment becomes obstruction of justice.³

That is why the charges that actually stuck were 18 U.S.C. § 1505 — obstructing an agency proceeding — and § 4, misprision of a felony: concealing a crime you know about.³ Neither is about the mechanics of the payment. Neither is about hiding the breach from users. Both are about the one audience Uber was legally forbidden to mislead: the regulator already in the room.

The charge everyone remembers was quietly dropped: the $100,000 payoff generated the loudest headlines and the weakest conviction

This is the part the retellings skip. Prosecutors did try to nail Sullivan on the payment. A superseding indictment added three wire-fraud counts tied directly to the $100,000 disguised as a bug-bounty reward.⁴ Then, shortly before trial, the government agreed to dismiss those very counts. The jury convicted on obstruction and misprision alone.⁴ The most vivid, most quotable element of the whole affair — a company paying criminals hush money — is the element the conviction does not rest on. The state kept the boring counts and dropped the cinematic ones, because obstruction was the charge it could actually prove.

A landmark conviction that ended in community service: the first executive tried for a breach cover-up got no prison time at all

The second distortion is the sentence. This was, by wide agreement, likely the first time a security executive faced criminal charges for mishandling a data breach — a genuine landmark.⁶ Yet on May 4, 2023, Judge William Orrick handed down three years' probation, 200 hours of community service, and a $50,000 fine.⁵⁶ Prosecutors had pushed for 15 months of actual incarceration and did not get it.⁶ For a man who faced years in prison, the outcome was a precedent that lands like a warning shot rather than a body blow. The Ninth Circuit unanimously upheld the conviction in March 2025, so the principle stands — an executive can be criminally liable for how a breach is concealed — but the price attached to that principle, so far, is a résumé stain and some volunteer hours.

And then the third distortion, the loudest silence in the whole story. The judge who convicted Sullivan said in open court that he believed Kalanick — Uber's CEO at the time, who had allegedly discussed a strategy for handling the breach with Sullivan — was 'just as culpable.'⁷ Kalanick was never charged. He instead submitted a character letter supporting Sullivan before sentencing, a gesture the judge found notable precisely because Kalanick was neither a defendant nor a trial witness.⁶ So the person the sentencing judge thought equally guilty appeared in the case only as a reference for the one man who was convicted.

Where the real money went: the company paid a record penalty while the individual paid in reputation

Follow the actual damage and the asymmetry sharpens. Uber tracked the hackers down, extracted assurances the data was deleted, and then waited a full year — until November 2017 — to disclose anything.⁹ For that delay the company paid a record $148 million to settle with all 50 states and the District of Columbia in September 2018, for violating state breach-notification laws by intentionally concealing the intrusion.⁸ Texas alone took more than $6.4 million of it.⁹ The corporate entity absorbed a nine-figure fine; the individual absorbed a felony record and community service; the CEO absorbed nothing. That is the map of accountability this case actually drew.

Isn't a conviction still a conviction?: the precedent is real even if the punishment was mild — and that is the uncomfortable part

The fair objection is that all of this parsing risks trivializing a real conviction. Sullivan was found guilty of two felonies by a jury, and an appeals court unanimously agreed the verdict was sound.¹⁰ A security chief is now, undeniably, a person who can go to trial for how a breach is buried — and that alone changes the incentive math for every CISO in the country. True. The precedent is the point, and it is durable. But the honest reading is that the precedent is narrower than the folklore. It does not say 'don't pay ransoms' and it does not say 'don't hide breaches from the public.' It says one thing with force: do not conceal from an investigator who is already investigating you. The line the law drew is not around bad crisis judgment. It is around lying to the government. Sullivan crossed a specific, bright line, at a specific, unlucky moment, ten days after being sworn in as a witness against his own company's future.

The neat headline says Uber's security chief was convicted for paying off hackers and covering up a breach. Strip it down and almost every load-bearing word is off. He wasn't convicted for the payment — those counts vanished before trial. He wasn't sent to prison — he got probation and a fine. And he wasn't the only culpable party — merely the only charged one. What survives the demolition is a smaller, harder truth: the crime that stuck was not hiding a breach from 57 million people. It was hiding it from the one person already asking. In a cover-up, the audience you fool is a scandal. The audience you fool while they're investigating you is a felony.