In a San Jose courthouse in California on Wednesday, Brandon Charles Glover (26) of Florida and Vasile Mereacre (23) of Toronto admitted they accessed and downloaded confidential corporate databases on Amazon Web Services using stolen credentials.
After downloading the data, the duo contacted affected companies to report security vulnerabilities and demanded money in exchange for the deletion of the data, according to a press release published by the US Justice Department.
"I was able to access backups upon backups, me and my team would like a huge reward for this," the hackers said to the victim company in an email.
"Please keep in mind, we expect a big payment as this was hard work for us, we already helped a big corp which paid close to 7 digits, all went well."
As The Hacker News reported two years ago, the hackers managed to inappropriately accessed and downloaded sensitive information of 57 million Uber riders and drivers, for which Uber reportedly paid the duo $100,000 in bitcoin in an attempt to cover up the breach.
"The defendants used false names to communicate with the victim-corporations, and, on several occasions, informed the victim-corporations that they had been paid by other victim-corporations for identifying security vulnerabilities," the indictment reads.
"They also sent the victim-corporations a sample of the data in order for the victim-corporations to verify the authenticity of data."
The indictment also revealed that the duo blackmailed LinkedIn in the same way in December 2016, informing the company that they had compromised databases of LinkedIn's subsidiary Lynda.com and stole over 90,000 user records, including their credit card information.
At that time, it was also reported that Uber sent its forensic team to the hackers' house in Florida and Canada to analyze their computers to make sure all the stolen data had been wiped and had the hackers also sign a non-disclosure agreement to prevent further wrongdoings.
Uber waited a year to reveal the October 2016 data breach, for which it was later ordered by the attorneys general of all 50 states and the District of Columbia to pay $148 million across all 50 states and Washington DC to settle the investigation.
British and Dutch data protection regulators also hit the ride-sharing company with a total fine of approximately $ 1.1 million for failing to protect its customers' personal information during a 2016 cyber attack.
At the time, it was also reported that Uber hid the data breach incident from the U.S. Federal Trade Commission (FTC), which was investigating another hacking incident against the company, and only told the commission about the 2016 breach in late 2017 when the incident was made public.
Glover and Mereacre each pleaded guilty to one charge of conspiracy to commit extortion and are set to face a maximum of five years in prison and a fine of $250,000 when they are sentenced.
The duo has been released on bond and will be sentenced in March 2020.
