Uber Technologies, Inc. · data security · criminal prosecution · non-prosecution agreement · criminal appeal
What did Uber admit about concealing its 2016 data breach, and was former security chief Joe Sullivan's conviction upheld?
Uber was not charged or convicted. On 22 July 2022 it entered a non-prosecution agreement in which, according to the US Attorney's Office, it admitted to and accepted responsibility for the acts of its personnel in concealing the November 2016 data breach from the Federal Trade Commission. A federal jury convicted former Chief Security Officer Joseph Sullivan on 5 October 2022 of obstructing FTC proceedings and misprision of felony, and he was sentenced on 4 May 2023 to three years of probation and a $50,000 fine. The Ninth Circuit affirmed on 13 March 2025 and denied rehearing on 12 November 2025, and the US Supreme Court denied certiorari on 29 June 2026, so as of 30 October 2026 his conviction is final.
Last verified 30 October 2026. United States · Also concerns Joseph Sullivan
The record at a glance
| What was alleged? | Federal prosecutors in the Northern District of California charged that Sullivan, while the FTC was investigating Uber's data security, concealed a November 2016 breach of about 57 million user records and 600,000 driver licence numbers from the FTC, arranged a $100,000 bitcoin payment to the hackers in exchange for non-disclosure agreements, and hid the breach from Uber's new management.1,2 |
|---|---|
| Who made the claim? | US Attorney's Office for the Northern District of California, 20 August 2020 |
| How did Uber respond? | Uber's chief executive said in 2017 that the breach should not have happened, that the company failed to notify affected people and regulators at the time, and that two people who led the response had left. Uber later accepted responsibility in the non-prosecution agreement, according to the US Attorney's Office. Sullivan pleaded not guilty and his lawyer said his focus had been the safety of people's data. On appeal and in the Supreme Court he argued that the jury should have been instructed that obstruction under 18 U.S.C. 1505 requires a nexus to an agency proceeding.3,4,5,6 (the subject's position) |
| Was there an official finding? | The US Attorney's Office states that Uber admitted to and accepted responsibility for its personnel concealing the 2016 breach from the FTC in a 2022 non-prosecution agreement.1 Sullivan was convicted by a jury on 5 October 2022 of obstruction of FTC proceedings and misprision of felony.2 The Ninth Circuit affirmed the conviction and the US Supreme Court denied certiorari on 29 June 2026.4,5 |
| Was liability determined? | Yes, liability was determined. Determined as to Sullivan only: convicted by jury, conviction affirmed and final after certiorari was denied. Uber: not charged and not convicted. It resolved the matter by a non-prosecution agreement in which, according to the US Attorney's Office, it admitted to and accepted responsibility for its personnel's concealment of the breach. A non-prosecution agreement is not a charge or conviction.1,2,4,5 |
| What changed later? | As of 30 October 2026 Sullivan's conviction is final after the Supreme Court denied review on 29 June 2026, and Uber's non-prosecution agreement has been in effect since 22 July 2022.1,5 |
| When was this checked? | 30 October 2026 |
What was alleged?
Federal prosecutors in the Northern District of California charged that Sullivan, while the FTC was investigating Uber's data security, concealed a November 2016 breach of about 57 million user records and 600,000 driver licence numbers from the FTC, arranged a $100,000 bitcoin payment to the hackers in exchange for non-disclosure agreements, and hid the breach from Uber's new management.1,2
Made by US Attorney's Office for the Northern District of California on 20 August 2020.
What did Uber say?
Uber's chief executive said in 2017 that the breach should not have happened, that the company failed to notify affected people and regulators at the time, and that two people who led the response had left. Uber later accepted responsibility in the non-prosecution agreement, according to the US Attorney's Office. Sullivan pleaded not guilty and his lawyer said his focus had been the safety of people's data. On appeal and in the Supreme Court he argued that the jury should have been instructed that obstruction under 18 U.S.C. 1505 requires a nexus to an agency proceeding.3,4,5,6
"None of this should have happened, and I will not make excuses for it."
Dara Khosrowshahi, Uber chief executive (Uber newsroom statement), 21 November 2017. This is the subject's own account, not a finding.
What do independent records show?
Non-prosecution agreement with Uber Technologies, Inc.
US Attorney's Office for the Northern District of California, 22 July 2022
According to the office's announcement, Uber admitted to and accepted responsibility for the acts of its officers, directors, employees and agents in concealing the 2016 breach from the FTC, and admitted that its personnel failed to report the breach while an FTC investigation was pending. The office cited Uber's cooperation, a new leadership team's disclosure of the breach in late 2017, remediation, an October 2018 FTC order and a $148 million settlement with all 50 states and the District of Columbia.1
Jury verdict, United States v. Joseph Sullivan
US District Court for the Northern District of California (jury), Judge William H. Orrick, 5 October 2022
Guilty of obstruction of FTC proceedings under 18 U.S.C. 1505 and misprision of felony under 18 U.S.C. 4.2
Sentence, United States v. Joseph Sullivan
US District Court for the Northern District of California, Judge William H. Orrick, 4 May 2023
Three years of probation and a $50,000 fine. Reporting states 200 hours of community service were also ordered and that prosecutors had sought 15 months in prison.7,8,9
Opinion, United States v. Sullivan, No. 23-927
US Court of Appeals for the Ninth Circuit, Judges M. Margaret McKeown, Anthony D. Johnstone and Ana de Alba, 13 March 2025
Affirmed the conviction. Held that circuit precedent forecloses a separate nexus instruction for 18 U.S.C. 1505, that any error in the duty to disclose instruction was harmless, that the evidence supported the misprision count and that admitting a hacker's plea agreement was not an abuse of discretion.4
Order and amended opinion, No. 23-927
US Court of Appeals for the Ninth Circuit, 12 November 2025
Issued an amended opinion, again affirming, and denied rehearing en banc.4
Sullivan v. United States, No. 25-1082, order denying certiorari
Supreme Court of the United States, 29 June 2026
Denied Sullivan's petition, which asked whether section 1505 requires a jury instruction on a nexus to an agency proceeding.5,6
What was established?
- The US Attorney's Office states that Uber admitted to and accepted responsibility for its personnel concealing the 2016 breach from the FTC in a 2022 non-prosecution agreement.1
- Sullivan was convicted by a jury on 5 October 2022 of obstruction of FTC proceedings and misprision of felony.2
- The Ninth Circuit affirmed the conviction and the US Supreme Court denied certiorari on 29 June 2026.4,5
Distinctions that matter here
- A non-prosecution agreement means no charges are filed against the company. It is not a conviction, although Uber accepted responsibility under it.
- Misprision of felony is the offence of concealing a known felony committed by others. Sullivan was not charged with the hacking itself.
- Denial of certiorari leaves the appeals court decision in place without a Supreme Court ruling on the merits.
Was liability determined?
Yes, liability was determined. Determined as to Sullivan only: convicted by jury, conviction affirmed and final after certiorari was denied. Uber: not charged and not convicted. It resolved the matter by a non-prosecution agreement in which, according to the US Attorney's Office, it admitted to and accepted responsibility for its personnel's concealment of the breach. A non-prosecution agreement is not a charge or conviction.1,2,4,5
What remains unresolved?
No open questions identified in the available records.
What is the current status?
As of 30 October 2026 Sullivan's conviction is final after the Supreme Court denied review on 29 June 2026, and Uber's non-prosecution agreement has been in effect since 22 July 2022.1,5
As of 30 October 2026. No next proceeding is scheduled in the records we found.
Timeline
- Hackers contact Sullivan about the breach, ten days after he testified to the FTC on 4 November 2016, according to prosecutors.2
- Uber publicly discloses the 2016 incident.3
- Federal charges against Sullivan announced.2
- Uber non-prosecution agreement announced.1
- Jury convicts Sullivan on both counts.2
- Sullivan sentenced to probation.7,9
- Ninth Circuit affirms.4
- Amended opinion issued and rehearing denied.4
- Supreme Court denies certiorari.5
Sources
- US Attorney's Office for the Northern District of California, Uber Enters Non-Prosecution Agreement Related to 2016 Data Breach, 22 July 2022 · document record Government, parliamentary or audit document
- US Attorney's Office for the Northern District of California, Former Chief Security Officer Of Uber Convicted Of Federal Charges For Covering Up Data Breach Involving Millions Of Uber User Records, 5 October 2022 · document record Government, parliamentary or audit document
- Uber Newsroom (Dara Khosrowshahi), 2016 Data Security Incident, 21 November 2017 · document record Filing or formal statement by the subject
- US Court of Appeals for the Ninth Circuit, United States v. Joseph Sullivan, No. 23-927, order and amended opinion, 12 November 2025 · document record Court, legislation, official register or regulator record
- Supreme Court of the United States, Docket No. 25-1082, Joseph Sullivan v. United States, 29 June 2026 · document record Court, legislation, official register or regulator record
- Supreme Court of the United States (filed by counsel for Joseph Sullivan), Petition for a writ of certiorari, Sullivan v. United States, No. 25-1082, 12 March 2026 · document record Filing or formal statement by the subject
- US Attorney's Office for the Northern District of California, Former Chief Security Officer Of Uber Sentenced To Three Years' Probation For Covering Up Data Breach, 5 May 2023 · document record Government, parliamentary or audit document
- The Record by Recorded Future, Appellate court upholds sentence for former Uber cyber executive Joe Sullivan, 14 March 2025 Independent reporting
- The Register, Ex-Uber CSO gets probation for covering up theft of data on millions of people, 5 May 2023 Independent reporting
- US Court of Appeals for the Ninth Circuit, United States v. Joseph Sullivan, No. 23-927, opinion, 13 March 2025 · document record Court, legislation, official register or regulator record
Revision history
- 30 October 2026: First published after source verification.
Related: Uber Technologies, Inc., data security, criminal prosecution, non-prosecution agreement, criminal appeal, United States. To submit a document or request a correction, see right of reply.