In November 2016, "John Doughs" emailed Joe Sullivan, Uber's chief security officer: "I have found a major vulnerability in Uber." It was the worst kind of message a security team can receive, and what Uber did with the next year is why I plan incident response differently from most site owners.
The setup is quick to tell. Two intruders got into Uber employees' GitHub accounts, found Amazon Web Services credentials inside, and used them to read rider and driver data stored on S3: names, emails and phone numbers of 57 million people, plus license numbers of about 600,000 US drivers. Then they emailed the security team and asked for money.
What happened next is the part worth an article. Uber paid them $100,000 through its bug bounty program and had them sign non-disclosure agreements - contracts that, as federal prosecutors later wrote, falsely represented that the hackers had not taken any data. Then the company told no one. Not the 600,000 drivers whose license numbers had walked out. Not law enforcement. The FTC was actively investigating Uber over a 2014 breach, and Sullivan had testified about that older breach ten days before he began the concealment. Uber settled the FTC matter in summer 2016 without mentioning the new one.
For a year, the silence held. It ended only because the board changed and a new CEO, Dara Khosrowshahi, started asking questions. The company disclosed the incident publicly in November 2017 and fired Sullivan. The harm from the stolen data itself was never proven - nobody showed it was misused. The harm from the year of hiding was measured to the dollar: $148 million, the settlement all 50 states and the District of Columbia announced in September 2018, plus a federal jury convicting Sullivan in October 2022 of obstruction of the Federal Trade Commission's proceedings and misprision of felony. He received three years of probation and a $50,000 fine in May 2023. Uber itself escaped prosecution through a non-prosecution agreement that credited, in the DOJ's own words, the new leadership's "strong tone from the top" and its "voluntary disclosure in November 2017."
The intruders were paid $100,000 and walked. The concealment cost $148 million and a felony conviction. That ratio is my thesis. Most small companies spend their security budget on preventing a break-in and assume incident response is the same purchase. It is not. When prevention fails, the expensive mistakes are not technical. They are about what you say, to whom, and how fast.
Why hiding feels so rational in the room
There is a reason the cover-up is the common failure mode: in the moment, hiding is cheaper. Nobody in that room was stupid. Uber had real exposure. A regulator was actively asking questions about an earlier breach, the license numbers triggered state notification laws, and the disclosure clock was already running. Paying $100,000, dressing it up as a bounty, and collecting NDAs probably looked like the option that kept the quarter and the investigation intact. The lie had a price tag; the truth looked like it had a bigger one.
The mistake was pricing only the first year of the lie. A concealed breach does not age. It sits on the books like undisclosed debt, and everything that touches it later costs more: the FTC settlement Uber had to reopen, the 50-state investigation, the filings the board had already signed. The $148 million was not the price of the intruders' access. It was the price of the year between the incident and the truth.
Hiding also does something the break-in never did: it converts a security event into a personal crime. Sullivan was not convicted for the breach. He was convicted for obstruction and concealment - charges that exist only because of what he did with his knowledge after the fact. The person who hides a breach is not merely failing to fix it; he is creating a new offense with his own name on it, one that survives even if the data is never misused. No one ever proved the stolen Uber data harmed anyone. The conviction and the $148 million happened anyway.
What this means on Bid Spotlight
I run a leaderboard where owners bid real money for rank, so my incident plan is written for the data the site actually holds, not a fantasy inventory. The submission form collects a site URL and an email. That is the entire private surface - the listing itself is advertising copy the owner chose to publish. There are no user passwords to leak and no card numbers to steal, because charges run through Stripe's hosted checkout, and a rank moves only when a verified checkout webhook lands. If a bad day comes, the first question in my plan is not "how do we keep this out of the press?" It is "how many emails do we have to send, and how fast can they go out?"
The hiding decision is made before the incident
The Uber jury heard that Sullivan told a subordinate they "can't let this get out." That sentence was available because nothing in the company's process made disclosure the default. A decision like that cannot be left to whoever is most scared at 2 a.m. on discovery day, so it has to be made in advance, in daylight, in writing. My plan is one boring page: who declares an incident, who writes the disclosure email, a hard rule that no money ever changes hands with an intruder - the moment you pay someone who holds your data, you have bought the concealment, not the fix - and a second pair of eyes on every public sentence about the incident, because Sullivan's three-paragraph summary to his own CEO left out the $100,000 payment and the number of people affected, and that omission became the crime.
I am not claiming regulators reward honesty with a discount; the $148 million landed even though Uber eventually told the truth. But read the ledger as a whole: the intrusion produced no measurable bill, and every dollar of the settlement, the prosecution and the probation attaches to the hiding. The second act is where the money goes.
So the next time a breach makes the news, watch the second act, not the first. The first act is usually the same: someone found credentials somewhere and read what they should not have. The second act is a decision. If you run a site that holds other people's anything, write your disclosure plan before you need it - and if that site deserves more eyes, submit it to the leaderboard today.