How the Uber breach happened: a cloud key left in the code, and a $100,000 cover-up

The 2016 Uber hackers did not break any encryption. They logged into employees' code accounts with passwords recycled from an old leak at another company, and found a key to Uber's cloud storage sitting in the code.^[1] This case file covers how that key exposed data on 57 million people, how the breach was paid off and hidden for a year, and the control that would have kept the door shut.

What happened

How they got in

According to trial testimony from an Uber security manager, the attackers started with usernames and passwords exposed years earlier in a large breach at LinkedIn. Some Uber engineers had reused those same passwords on their accounts at GitHub, a service where developers store and share code.^[1]

Inside Uber's private code, the attackers found an access key for Uber's Amazon cloud storage. An access key works like a password for a program rather than a person, and whoever holds it can use it from anywhere. That key opened a storage bucket holding more than 200 files of user and driver data, which the attackers downloaded.^[1]

So 2 weaknesses lined up: reused passwords let outsiders into the code, and a secret left inside the code turned a look at source files into a copy of the customer database.

What it cost

The cover-up turned out to be more expensive than the breach. In September 2018 Uber agreed to pay $148 million to settle claims from all 50 states and Washington, D.C., which said it had broken breach notification laws by waiting more than a year to tell people.^[5] Uber also fired Sullivan and a deputy over their handling of the incident.^[5]

The 2 hackers pleaded guilty to computer fraud conspiracy on October 30, 2019. Prosecutors said that after the Uber payout, they breached another company, Lynda.com, and tried to ransom that data too.^[2][3]

On October 5, 2022, a federal jury convicted Sullivan of obstructing the FTC's proceedings and of misprision of a felony, which means actively concealing a crime he knew about.^[2] In May 2023 a judge sentenced him to 3 years of probation, a $50,000 fine and 200 hours of community service. Prosecutors had asked for 15 months in prison.^[4] The Ninth Circuit upheld the conviction on March 17, 2025.^[6] It was widely seen as the first time a corporate security chief was criminally convicted over a breach response.

The missing control

The missing control: keeping secret keys out of code. Passwords, access keys and tokens that let software reach live data should be stored in a locked-down secrets vault, not written into files that dozens of developers and any compromised account can read.

If the storage key had not been in the code, the reused passwords would have exposed source files but not the personal data of 57 million people. Reused passwords were the first failure, and multi-factor sign-in on developer accounts would have blocked that step too. But secrets in code are the kind of mistake that turns a small intrusion into a headline. The second lesson is just as plain: a breach you hide becomes a much larger legal problem than the one you report.

What to do in your business

• Search your code and shared files for secrets. Ask your developer or IT provider to scan code repositories, scripts and shared drives for stored passwords, API keys and cloud keys, and to move any they find into a password manager or secrets vault.
• Rotate any key that has ever been exposed. A key that sat in code or email should be treated as known to outsiders. Replace it, then delete the old one.
• Require multi-factor sign-in on code and cloud accounts. Turn it on for GitHub, your cloud provider, your website host and anything else that holds your data or code.
• Ban password reuse with a password manager. Give staff a tool that creates unique passwords, so a leak at one site does not unlock another.
• Write down who you must notify after a breach. Know your state's notification rules, your insurer's number and your lawyer's contact before you need them. Paying for silence is not a plan.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.