Rogue HackerOne employee steals bug reports to sell on the side


Level 76
Thread author
Honorary Member
Top Poster
Content Creator
Apr 24, 2016
A HackerOne employee stole vulnerability reports submitted through the bug bounty platform and disclosed them to affected customers to claim financial rewards.

The rogue worker had contacted about half a dozen HackerOne customers and collected bounties “in a handful of disclosures,” the company said on Friday.

HackerOne is a platform for coordinating vulnerability disclosures and intermediating monetary rewards for the bug hunter submitting the security reports.
HackerOne notes that its former employee had used “threatening” and “intimidating” language in their interaction with customers and urged customers to contact the company if they received disclosures made in an aggressive tone.

The company says that “in the vast majority of cases” it has no evidence of vulnerability data having been misused. However, customers that had reports accessed by the inside threat actor, either for nefarious or legitimate purposes, have been informed individually of dates and times of access for each vulnerability disclosure.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.