in 2016, uber experienced a security incident when an individual accessed the personal information of 57 million uber users worldwide. the individual supposedly demanded a ransom of $100,000 in order to destroy the users’ data. in congressional testimony, uber ciso indicated that the company verified that the data had been destroyed before paying the $100,000. mr. flynn expressed regret that uber did not disclose the incident in 2016. as part of their response to this incident, uber worked with partner hackerone to update their bug bounty program policies to, among other things, more thoroughly explain good faith vulnerability research and disclosure.