On 21 November 2017, Uber's new chief executive, Dara Khosrowshahi, disclosed that two outsiders had downloaded personal data on about 57 million riders and drivers in late 2016, and that the company had kept the breach quiet for a year. The route in was a machine credential. According to the US Federal Trade Commission (FTC), the intruders reached Uber's private GitHub repositories, found an Amazon Web Services (AWS) access key that Uber engineers had posted there, and used it to download unencrypted backup files from Uber's Amazon S3 storage between 13 October and 15 November 2016. Uber paid the attackers $100,000 through its bug bounty programme and did not tell regulators or the people affected. The cover-up led to a revised FTC settlement in April 2018, guilty pleas from the two hackers in October 2019 and the 2022 criminal conviction of Uber's former chief security officer.
Key takeaways
- Data on about 57 million Uber users worldwide was downloaded in late 2016, including the names and driver's licence numbers of about 600,000 US drivers, according to Uber's own statement of 21 November 2017.
- The FTC says the intruders used an AWS access key that Uber engineers had posted to GitHub to reach Uber's Amazon S3 datastore, and that Uber did not require engineers to use multi-factor authentication on GitHub.
- The FTC lists about 25.6 million names and email addresses, 22.1 million names and mobile numbers and 607,000 names and driver's licence numbers in sixteen unencrypted files.
- Uber paid the attackers $100,000 through its bug bounty provider and disclosed the breach only in November 2017. The two hackers pleaded guilty in 2019 and former security chief Joe Sullivan was convicted in 2022.
- The identity lesson: a long-lived cloud key stored in a code repository is only as safe as the weakest password that can open that repository.
At a glance
| Organisation | Uber Technologies |
|---|---|
| When | Intrusions between 13 October and 15 November 2016, according to the FTC; ransom email 14 November 2016; disclosed by Uber on 21 November 2017 |
| Attacker | Two individuals outside the company who later pleaded guilty to computer fraud conspiracy in the US (October 2019), according to the US Department of Justice |
| Entry point | Uber's private GitHub repositories, which the FTC says the intruders reportedly reached with passwords exposed in other large data breaches |
| Identities abused | An AWS access key posted to GitHub by Uber engineers, which gave access to Uber's Amazon S3 datastore; engineers' GitHub accounts without multi-factor authentication |
| Impact | Names, email addresses and phone numbers of about 57 million users and driver's licence numbers of about 600,000 US drivers downloaded; $100,000 paid to the attackers; a year-long cover-up |
| Category | NHI. Incident class: confirmed NHI breach (a leaked cloud access key used to download customer data) |
What happened
Uber had already been in trouble over a cloud key. The FTC was investigating a 2014 breach in which, it says, an intruder reached Uber's Amazon S3 datastore with an access key that had been publicly posted. While that investigation was still open, the same pattern repeated. In its analysis of the revised consent order, the FTC says that "intruders accessed Uber's Amazon S3 Datastore multiple times using access keys that Uber engineers had posted to GitHub" between 13 October and 15 November 2016. According to the FTC, the intruders reportedly got into Uber's GitHub page using passwords that had been exposed in other large data breaches. The commission adds that Uber "did not require engineers to enable multi-factor authentication when accessing Uber's GitHub repositories" and had no policy against engineers reusing credentials.
Bloomberg, which broke the story on 21 November 2017, described the same chain: two attackers accessed a private GitHub coding site used by Uber software engineers, used login credentials they found there to reach an AWS account that handled computing tasks for Uber, found an archive of rider and driver information and then emailed Uber asking for money. The FTC says the attackers downloaded sixteen files of unencrypted consumer data from database backups, nearly all collected before July 2015.
The ransom demand reached Joe Sullivan, then Uber's chief security officer, on 14 November 2016, according to the US Department of Justice. Uber paid the attackers $100,000 in December 2016 through the third party that runs its bug bounty programme, and had them sign non-disclosure agreements that, prosecutors said, falsely stated they had not taken or stored any data. The FTC says the attackers were not legitimate bug bounty participants because they had exploited the weakness rather than reporting it. Uber identified both people in January 2017.
New management investigated the incident in autumn 2017. In his statement, Khosrowshahi said Uber's corporate systems and infrastructure were not breached, that forensic experts saw no sign that trip histories, card numbers, bank account numbers, Social Security numbers or dates of birth were downloaded, and that the company had seen no evidence of fraud. "None of this should have happened, and I will not make excuses for it," he wrote. Bloomberg reported that Sullivan was ousted and a senior lawyer who worked for him was fired. In April 2018 the FTC expanded its settlement with Uber. Then Acting Chairman Maureen Ohlhausen said: "After misleading consumers about its privacy and security practices, Uber compounded its misconduct" by not telling the commission about the 2016 breach. The two hackers pleaded guilty on 30 October 2019, and a jury convicted Sullivan on 5 October 2022 of obstructing FTC proceedings and misprision of a felony.
Timeline
| Date | Event |
|---|---|
| 13 October 2016 | First of the intrusions into Uber's Amazon S3 datastore, according to the FTC; they continue until 15 November 2016. |
| 14 November 2016 | The attackers email Uber's chief security officer claiming to have stolen data and demanding payment. |
| December 2016 | Uber pays the attackers $100,000 through its bug bounty provider in exchange for non-disclosure agreements. |
| January 2017 | Uber identifies the two attackers and has them sign new agreements in their real names. |
| 21 November 2017 | Dara Khosrowshahi discloses the 2016 breach; Bloomberg reports how the attackers got in. Uber tells the FTC the same month. |
| 12 April 2018 | The FTC announces an expanded settlement requiring Uber to report future incidents. |
| 30 October 2019 | The two attackers plead guilty to computer fraud conspiracy in the Northern District of California. |
| 5 October 2022 | A federal jury convicts former Uber security chief Joe Sullivan over the cover-up. |
How it happened: the identity attack path
- Reused passwords open the code host. According to the FTC, the intruders reportedly logged in to Uber's GitHub page with passwords exposed in earlier breaches at other companies. Engineers were not required to use multi-factor authentication there.
- A cloud key sits in the code. Inside the private repositories was an AWS access key that Uber engineers had posted, a static credential that worked from anywhere.
- The key opens cloud storage. The attackers used the key to reach Uber's Amazon S3 datastore. The FTC also says Uber did not require multi-factor authentication for programmatic service account access until at least November 2016.
- Unencrypted backups are copied. The datastore held unencrypted database backup files. The attackers downloaded sixteen of them, containing data on tens of millions of riders and drivers.
- Extortion and concealment. The attackers demanded money; Uber paid $100,000 through its bug bounty provider and did not disclose the breach for a year.
Impact
- Confirmed data exposure: names, email addresses and mobile numbers of about 57 million users worldwide and names and driver's licence numbers of about 600,000 US drivers, according to Uber. The FTC's count is about 25.6 million names and email addresses, 22.1 million names and mobile numbers and 607,000 names and licence numbers.
- Not affected, according to Uber: trip location history, credit card and bank account numbers, Social Security numbers and dates of birth showed no sign of being downloaded. Uber said it had seen no evidence of fraud and offered affected drivers free credit monitoring.
- Regulatory and legal: a revised FTC consent order in 2018 with reporting duties and third-party audits, guilty pleas from both attackers in 2019 and the 2022 conviction of Uber's former chief security officer.
- Trust: the year-long delay and the payment framed as a bug bounty turned a data breach into a regulatory and criminal case against the company and its former security chief.
What this means for NHI governance
The 2016 Uber breach is remembered for the cover-up, but the technical failure was a machine identity problem. A long-lived AWS access key was committed to source code, the code host was protected only by engineers' passwords, and the key had enough access to read bulk customer backups. Each of those is an NHI governance gap: no secret hygiene in repositories, no strong authentication in front of the place where secrets were kept, and no least-privilege scoping or network restriction on the key itself. Uber had been through a near-identical incident in 2014, which shows how hard it is to fix a credential problem by fixing one credential.
The same pattern runs through later incidents in our database. A cloud key left in code led to the Toyota T-Connect Key Exposure 2022, and a stolen AWS API key sat behind the Imperva Cloud WAF breach 2019. Keeping keys out of repositories, preferring short-lived role credentials and monitoring where keys are used from are covered in our Secrets Management Guide and Cloud Workload Identity Guide. This page covers the 2016 incident; Uber's separate 2022 breach, which began with a contractor's password and MFA fatigue, is described in Uber Breach 2022.
Recommendations
- Keep cloud keys out of source code, including private repositories. Store keys in a secrets manager and inject them at runtime, and scan repositories and their full history for secrets. See our Secrets Management Guide.
- Replace long-lived access keys with short-lived role credentials. Workloads should assume roles that issue temporary credentials rather than carry static keys. See the Cloud Workload Identity Guide.
- Require phishing-resistant MFA on code hosting accounts. A repository that holds or builds production systems needs the same protection as the production console. See our MFA Guide.
- Scope and fence every key. A key used by engineers should not be able to read bulk customer backups; restrict it by permission, resource and source network. See the Cloud PAM and CIEM Guide.
- Encrypt backups and alert on bulk reads. Unusual downloads from storage buckets, especially by human-held keys, should raise an alert within minutes.
- Treat an extortion email as an incident, not a bounty. Rotate every credential the attacker could have reached, investigate and meet notification duties. See the Leaked Credential Response Playbook.
Frequently asked questions
How did hackers get into Uber in 2016?
According to the FTC, the intruders reportedly logged in to Uber's private GitHub repositories with passwords exposed in other breaches, found an AWS access key that Uber engineers had posted there, and used it to download unencrypted backup files from Uber's Amazon S3 storage between October and November 2016.
How many people were affected by the 2016 Uber breach?
Uber said names, email addresses and phone numbers of about 57 million users worldwide were taken, including the names and driver's licence numbers of about 600,000 US drivers. Uber said trip histories, payment card and bank numbers, Social Security numbers and dates of birth showed no sign of being downloaded.
Why did Uber pay the hackers $100,000?
Uber paid the attackers through its bug bounty provider in December 2016 in exchange for non-disclosure agreements and assurances that the data had been destroyed. The FTC said the attackers were not legitimate bug bounty participants, and prosecutors later convicted Uber's former security chief over the concealment.
Related NHI Mgmt Group resources
Uber Breach 2022 · Imperva Breach 2019 · Toyota T-Connect Key Exposure 2022 · Secrets Management Guide · Leaked Credential Response Playbook
How NHI Mgmt Group can help
Cloud keys in code repositories remain one of the most common starting points in our breach database, nearly a decade after Uber. We help organisations find the keys they already have in code, move them into managed storage, replace them with short-lived credentials and give each one an owner. See our NHI and AI agent security training.
References
- Uber (Dara Khosrowshahi): 2016 Data Security Incident (21 November 2017)
- American Banker (Bloomberg News): Uber concealed cyberattack that exposed data on 57M people (21 November 2017)
- AWSInsider: Uber Discloses Year-Old AWS Data Breach, Exposing Millions of Users (21 November 2017)
- US Federal Trade Commission: Uber Technologies, Analysis of Proposed Consent Order to Aid Public Comment (revised) (April 2018)
- US Federal Trade Commission: Uber Agrees to Expanded Settlement with FTC Related to Privacy, Security Claims (12 April 2018)
- US Attorney's Office, Northern District of California: Former Chief Security Officer Of Uber Convicted Of Federal Charges For Covering Up Data Breach Involving Millions Of Uber User Records (5 October 2022)