Ex-Uber CSO convicted for the cover-up of a massive data breach avoids jail

Former Uber Chief Security Officer (CSO) Joseph Sullivan, convicted last October for trying to cover up a massive data breach affecting over 50 million customers and more than half a million Uber drivers, will not serve time as part of his sentence.

Instead, the 50-year-plus Sullivan was sentenced to three years of probation and a $50,000 fine for obstruction of justice and trying to conceal the Uber breach from authorities back in 2016 when it happened.

Its the first time a corporate executive has been convicted of criminal charges in relation to a data breach, setting a precedent for future cases in the US.

Sullivan was sentenced in Northern California’s federal district court late Thursday.

US Department of Justice prosecutors were hoping for a 15-month prison sentence out of the potential eight years maximum allowed for his crimes.

Sullivan was at Uber for barely a year when two hackers breached internal databases in October 2016, stealing the personal records of approximately 57 million users and 600,000 Uber drivers, including social security numbers, emails, and driver's license numbers.

Fearful of public backlash, instead of alerting the US Federal Trade Commission, as required by law, the CFO paid the hackers $100,000 in Bitcoin in exchange for their silence.

At the time, Sullivan – once a federal prosecutor himself early on in his career – also attempted to block investigators and other C-suite executives from finding out about the deal.

The federal judge presiding over the hearing said the lighter sentence was a lesson for the CFO, not to be misconstrued for leniency.

The judge said he considered the fact that Sullivan was not acting from a place of greed, but out of loyalty to Uber, proving atypical from other white collar crimes.

Over 200 character testimony letters, many written by other industry executives in Sullivan’s favor, were also considered to have swayed the judges decision.

CFOs from other major US companies have been following the case closely, worried about how the outcome could impact their own liabilities involving future data breach cases.

Sullivan, who was fired from Uber soon after the debacle, was previously the CFO at both Cloudflare and Facebook.

He is currently the CEO of Ukraine Friends, a non-profit that delivers humanitarian aid to the people of Ukraine.