Secondary sources, including federal and state court records, news articles and press releases, support this case study. This research followed a systematic approach, starting with researching court records and Uber press releases to verify facts about the 2106 breach, followed by news outlets to provide context. After researching the 2016 data breach, the authors conducted additional research regarding the culture of Uber during this time and its history as background information. Finally, the authors looked for more recent interviews with Sullivan to gain insight into his perspectives during this time.
In 2016, two hackers accessed Uber’s cloud-based repository and downloaded over 57 million usernames along with email addresses, mobile phone numbers and driver’s license numbers. The hackers demanded a ransom in exchange for the data (Wong, 2017; Wright, 2022). At the time of the ransom demand, Uber was still under investigation by the Federal Trade Commission for a 2014 data breach. Uber’s chief security officer, Joe Sullivan, was responsible for handling Uber’s response.
Uber’s culture at this time valued competitiveness, risk-taking and growth at any cost. Many examples are provided showing how Uber’s culture impacted decision-making throughout the company, including questionable growth strategies such as “greyballing,” pushing drivers to work longer hours, and instances of sexual harassment and workplace bullying.
How should Sullivan respond to the ransom demand, given the organizational, personal and legal pressures he was facing as the new chief technology officer of Uber?
Learning objectives for this case are aimed at second- and third-year undergraduate courses. Upper-level undergraduate courses such as principles of management, organizational behavior, corporate social responsibility, business ethics and business law courses would be appropriate. In general, this case would be appropriate for second- or third-year undergraduate courses that cover managerial decision-making or ethical frameworks, including decision-making.
