Uber paid 20-year-old Florida man to keep data breach secret
Pentester here.<p>If any pentester would download more data than necessary to prove a bug exists, they would be fired.<p>I don&#x27;t know whether this person downloaded 57M user records. Maybe it was a 500kb zip file, which would be totally reasonable to grab in a pentest. And then once you realize what it is, you run `srm` on it to ensure it&#x27;s wiped, then immediately call the client so they can deploy an emergency hotfix and perform forensic analysis to see if the data had already been nabbed.<p>We know he contacted Uber. We don&#x27;t know whether he said &quot;Give me $100k and I&#x27;ll delete the data&quot; or &quot;Give me $100k and I&#x27;ll keep my mouth shut&quot; or if Uber offered him the $100k or any details at all. In this scenario, it&#x27;s better to assume the best until proven otherwise. And by &quot;proof&quot; I mean &quot;emails showing what was said,&quot; not a second-hand news report that attempts to spin it into an easily clickable form.<p>But I suppose it could have gone the other way too, and maybe he did. The point is, it&#x27;s totally reasonable for Uber to raise the price until he was willing to keep quiet about it. If I ran into this bug in the wild, I would be ethically obliged to report it to you, dear readers, after a reasonable time period. But I suppose certain ethics would take a back seat to $100k in my pocket, and I&#x27;m not ashamed of that.<p>But it depends on the data. If we&#x27;re talking SSNs, that could really screw up peoples&#x27; lives, so I don&#x27;t think I&#x27;d be able to be bought. CC numbers I&#x27;d probably overlook, since you can&#x27;t really mess with someone&#x27;s life by stealing their CC number. They just get refunded. (edit: On the other hand, businesses eat the cost of fraud, so this would probably need to be reported.)<p>The point is, it&#x27;s a big complex topic and there are a bunch of things we don&#x27;t know. But above all, if you are ever holding data hostage and demanding money to destroy it, you&#x27;re not a pentester, you&#x27;re a chump.<p>edit2: it occurs to me that maybe the 20yo wanted to hold the data in order to prove to the world that the breach really did happen, i.e. his intent was altruistic. I could picture myself doing something misguided like that back when I was 20. But the trick is to keep only a few records at most, and redact everything sensitive. Then tell the truth. The company can&#x27;t lie and say it didn&#x27;t happen, since they don&#x27;t know whether you can prove that it did. And no one is at risk because the data is gone.