When it was hacked again, the attackers emailed Sullivan and told him they had stolen a large amount of data that they would delete in exchange for a ransom, according to the US Department of Justice DOJ The Washington Post. The firm eventually identified the pair - both of whom had been convicted of criminal offenses in January 2017 and required them to sign new agreements in their own names.
The seriousness of giving cyber-criminals what they want no longer carries the seriousness it used to, but companies must always be transparent about how they respond to cyber-incidents that affect them and their customers.
The DOJ said that Sullivan orchestrated these acts despite knowing that the hackers were hacking and extorting other companies as well as Uber, and that the hackers had obtained the data from at least some of the other companies. The court also heard that internal legal advice had suggested that there was no need to disclose the hack if the attackers were identified, and agreed to delete the data and not spread further.