Inside Uber’s $100,000 Payment to a Hacker, and the Fallout

How Uber grappled with a 2016 hack is under scrutiny and has cast a chill over how other companies deal with security threats.

SAN FRANCISCO — “Hello Joe,” read the November 2016 email from someone identifying himself as “John Doughs.” “I have found a major vulnerability in Uber.”The email appeared to be no different from other messages that Joe Sullivan, Uber’s chief security officer, and his team routinely received through the company’s “bug bounty” program, which pays hackers for reporting holes in the ride-hailing service’s systems, according to current and former Uber security employees.Yet the note and Uber’s e...