The Uber Breach: Extortion Does Not Equal Bug Bounty

Published

2017-11-27 00:00

Collected

2026-07-05 04:06

---
id: 3190
title: "The Uber Breach: Extortion Does Not Equal Bug Bounty"
source_domain: bugcrowd.com
source_url: "https://www.bugcrowd.com/blog/the-uber-breach-extortion-does-not-equal-bug-bounty/"
published_at: "2017-11-27T00:00:00Z"
tags: ["bug-bounty", "extortion", "data-breach", "ethics", "disclosure", "uber-breach"]
phying_url: "https://phying.com/item/3190"
lang: en
---

# The Uber Breach: Extortion Does Not Equal Bug Bounty

## Summary

Bugcrowd CSO David Baker clarifies that bounties pay for in-scope vulnerability findings, while Uber's concealed $100,000 payment was extortion, and failing to report the breach violated the law.

## Intelligence Metadata

- **Sources:** bugcrowd.com
- **Published:** 2017-11-27T00:00:00Z
- **Original:** https://www.bugcrowd.com/blog/the-uber-breach-extortion-does-not-equal-bug-bounty/
- **Phying News:** https://phying.com/item/3190