Uber Sued for Legal Fees by Ex-Security Chief Charged Over Hack

Uber Technologies Inc. was sued in Delaware Chancery Court by its former chief security officer, who says the Silicon Valley giant is breaching its pledge to cover the legal fees he’s racked up defending against federal criminal charges related to a 2016 data breach.

Uber has sought to avoid paying Joseph Sullivan’s expenses by claiming its board “never adopted formal written resolutions appointing Mr. Sullivan” or “defining Mr. Sullivan’s authority,” the complaint says. “Any purported failure of corporate formalities” is “a failure by Uber, not Mr. Sullivan, which the company cannot rely upon.”

Sullivan faces up to eight years in prison and six-figure fines for allegedly concealing a 2016 hack—which compromised the personal information of roughly 57 million Uber customers and drivers—from Federal Trade Commission officials who were already investigating a 2014 data breach at the time.

Uber paid $148 million to settle claims brought by state attorneys general over the second breach.

The ex-Uber executive, a former federal prosecutor, was charged in the U.S. District Court for the Northern District of California with obstruction of justice and concealing a felony. Obstruction of justice charges are extremely rare in the context of an agency proceeding, according to a Bloomberg Law analysis.

Prosecutors are seeking to hold Sullivan criminally liable both for failing to report the second breach and for engineering a complex scheme to affirmatively hide it from the FTC, including by laundering a $100,000 ransom through Uber’s “bug bounty” program, which rewards hackers for highlighting vulnerabilities.

After learning the identities of the hackers, Vasile Mereacre and Brandon Glover, Sullivan then allegedly failed to report them. Mereacre and Glover later pleaded guilty in connection with an unrelated hacking and extortion scheme involving LinkedIn Corp.

In his newly filed Delaware lawsuit, Sullivan says Uber had no problem acknowledging he was an officer until he sought legal fees connected to his role with the company.

He was even among “the small group of executives” that shared de facto CEO duties when Uber was between chief executives in 2017, according to the complaint docketed Wednesday.

Cause of Action: Section 145 of the Delaware General Corporation Law.

Relief: An order requiring the company to pay Sullivan’s defense costs and fees in the criminal case; “fees on fees” covering the Delaware case.

Response: Uber didn’t immediately respond to a request for comment Thursday.

Attorneys: Sullivan is represented by Morris James LLP, Angeli Law Group LLC, and John D. Cline of San Francisco. Uber was represented in earlier Chancery Court litigation by Abrams & Bayliss LLP.

The case is Sullivan v. Uber Techs Inc., Del. Ch., No. 2020-0856, complaint filed 10/7/20.