Sources: Kalanick and CSO Joe Sullivan ordered $100K ransom to be paid; Uber tracked the hackers, pushed them to sign NDAs, disguised the payment as bug bounty
SAN FRANCISCO — In November 2016, Uber executives faced an expensive — and risky — decision.
Context & Ripple Effects
The day after Bloomberg revealed that Uber had paid hackers $100,000 to delete data on 50 million riders and 7 million drivers — and fired chief security officer Joe Sullivan over it (the CSO's dismissal) — the New York Times adds the decision chain behind it: sources say Travis Kalanick and Sullivan personally ordered the November 2016 ransom payment, that Uber then tracked the attackers down, pushed them to sign nondisclosure agreements, and booked the payout as a bug bounty.
That last detail is what turns a breach story into a governance one. Routing an extortion payment through a bug bounty program sits at the center of the legal ambiguity tech companies' bounty programs now face, and it explains why the response has been regulatory rather than just reputational.
First-order effects
- Sullivan is already out, and the named decision-makers — Kalanick and Sullivan — now own the ransom order publicly, shifting the story from 'a hack happened' to 'executives concealed it.'
- Uber's legal exposure is active, not hypothetical: five US state attorneys general are investigating, the FTC has made contact, and at least three potential class actions are pending (the multi-state AG probes).
Second-order effects
- Uber's own CISO was pulled into congressional testimony conceding the breach should have been disclosed earlier and the bug bounty program should not have been used to negotiate with hackers (his statement to Congress) — meaning the company's defense strategy now runs through its own security leadership.
- Every security team running a paid vulnerability program inherits scrutiny from the disguise tactic: payouts to outside researchers will be read against the possibility they were something else.
Third-order effects
- If the pattern holds, breach-response decisions stop being purely operational and become personal-liability questions for named executives, with boards and general counsel inserted into ransom calls that CSOs previously handled alone.
- The conflation of extortion payments with bug bounties points toward formalized boundaries — clearer disclosure obligations and possibly regulation of how companies may pay attackers — because the informal channel Uber used has now been publicly disowned by its own practitioners.
The trend: Breach handling is migrating from a private negotiation between companies and attackers toward a regulated, executive-accountable process, with Uber's ransom-as-bug-bounty as the cautionary data point.