A CISO Almost Went to Prison for Hiding a Breach

A CISO Almost Went to Prison for Hiding a Breach.

Under NIS2, His Case Is Now Europe’s Template.

Most European executives still call this an American story.

On 5 October 2022, a federal jury in San Francisco convicted the former Chief Security Officer of Uber Technologies, on two felony counts.¹ He was the first CISO in history convicted of crimes connected to a cybersecurity breach. The breach itself was not the crime. The cover-up was.

Under NIS2, that comfort is no longer available. The directive — and the German BSIG that transposes it — now contains every component that turned a contained Uber breach into a criminal conviction: a personal duty on the management body, a hard reporting obligation, and the explicit statutory authority to hold individuals liable when those duties are breached.² The conditions differ. The legal architecture is functionally comparable.

This article walks through both: what the convicted CSO actually did, and what an EU executive doing the same thing today could face under Article 20, Article 23, Article 32, and §38 BSIG.

What happened in San Francisco

On 14 November 2016 — ten days after he had testified under oath to the Federal Trade Commission about Uber’s cybersecurity programme — he received an email from hackers who had breached the company’s systems for the second time.³ The breach was massive: 57 million user records and 600,000 driver licence numbers, exploiting the same category of vulnerability he had described to the FTC days earlier.

He did not disclose. He arranged for Uber to pay the attackers USD 100,000 in Bitcoin, routed through the company’s bug bounty programme, and required them to sign non-disclosure agreements that falsely characterised what they had done as authorised security research.⁴ He told a subordinate the incident “can’t let this get out.” He continued working on the FTC response — now based on materially incomplete information — and Uber negotiated a preliminary FTC settlement while the regulator was relying on a false picture of the company’s security posture.

After a four-week trial in 2022, the jury returned guilty verdicts on obstruction of FTC proceedings and misprision of a felony.⁵ In May 2023, the CSO was sentenced to three years’ probation, 200 hours of community service, and a USD 50,000 fine.⁶

The sentence stopped short of imprisonment. The warning attached to it did not. In delivering the sentence, the federal judge stated that future defendants in similar cases should expect custodial sentences regardless of mitigating factors — a remark every European executive responsible for security should commit to memory.⁷ On 13 March 2025, a unanimous Ninth Circuit panel upheld the conviction. The court was explicit: illegal conduct cannot be laundered through a non-disclosure agreement.⁸

The CSO was not convicted for the breach. His security team had detected it. He was convicted for the decision made at senior management level about what to do with the detection.

An EU CISO who detects a significant incident and decides — in concert with the management body — not to report it to the competent authority may no longer be making a risk management decision.⁹ Under the German NIS2UmsuCG and the parallel transpositions in Belgium, the Netherlands, France, and elsewhere, they are likely to be committing an administrative offence at minimum. Depending on the manner of the concealment, they may also be committing a criminal one.

The three acts and their European equivalents

The CSO was convicted not for one act but for three. Each maps onto a distinct part of the European framework, and the mapping is what makes the case more than an American curiosity.

Act 1 — The failure to report. He had testified to the Federal Trade Commission ten days before the breach. The breach itself triggered a regulatory disclosure obligation. He concealed it from the regulator. Under NIS2, this is the violation of Article 23(4)(a), the 24-hour early warning obligation, transposed into German law by §32 BSIG. The exposure here is primarily administrative: §65 BSIG translates the breach into an administrative offence carrying fines of up to €10 million or 2% of worldwide annual turnover for essential entities, whichever is higher.

Act 2 — The failure of governance. The breach was managed at senior management level without disclosure to Uber’s incoming CEO, the company’s lawyers, or the FTC. The decision to conceal was made and executed within the management function itself. Under NIS2, this is the violation of Article 20(1) — the management body’s obligation to approve cybersecurity measures, oversee implementation, and be held liable for breaches — transposed into German law by §38(1) BSIG. The exposure here may be twofold: civil damages liability under §38(2) BSIG, where the entity itself can sue the management body member for losses caused by the duty breach; and the administrative authority under Article 32(5)(b) for the supervisor to temporarily prohibit the individual from exercising managerial functions in essential entities.

Act 3 — The active concealment. The CSO paid the attackers USD 100,000 in Bitcoin through Uber’s bug bounty programme, required them to sign NDAs that falsely characterised what they had done as authorised security research, and continued to work on the FTC response while knowingly omitting the new breach. This is where the directive itself reaches its limit: NIS2 does not create criminal offences. National criminal law fills the gap. In Germany, the same factual pattern could activate §263 StGB (fraud, where pecuniary damage results), §269 StGB (falsification of legally relevant electronic data, particularly where falsified evidentiary records are created), and, in document destruction scenarios, §274 StGB (suppression of documents). These statutes carry custodial sentences, with aggravated fraud under §263(3) StGB reaching ten years.¹⁰ The management body that detects an incident and decides to conceal it is not in the same legal posture as the management body that simply failed to register on time.

The three acts are independently severe. The CSO committed all three. An EU executive in his position could face all three categories of consequence — civil damages, administrative sanction, criminal investigation — potentially on parallel exposure tracks, not sequential ones.

The other CISO: SolarWinds and a different shape of liability

The Uber CSO was not the last senior executive whose conduct produced personal exposure under cybersecurity law. On 30 October 2023, the U.S. Securities and Exchange Commission charged SolarWinds Corporation and its CISO with securities fraud and internal control failures connected to the SUNBURST attack — a Russian supply chain compromise. The threat actor first accessed SolarWinds in September 2019; the malicious update reached customers from March 2020 onwards, breaching approximately 18,000 organisations including multiple US federal agencies.¹¹

The SolarWinds theory was different from the Uber theory. The SEC alleged that the CISO had made internal presentations describing the company’s security programme as “in a very vulnerable state” while public disclosures to investors during the same period described a mature security posture. The mismatch between internal knowledge and public representation, the SEC argued, made the CISO personally liable.¹²

The case did not end in conviction. On 18 July 2024, the trial court at the Southern District of New York dismissed most of the SEC’s claims; the remaining claims were dismissed by stipulation with prejudice on 20 November 2025.¹³ The case did not result in personal sanctions against the CISO. But the case matters precisely because it was brought. It was the first time a CISO was personally charged with civil fraud over a security incident. The theory — that knowing internal security deficiencies while public statements describe a sound programme creates personal liability — has now been articulated, tested, and is likely to shape how the next case is constructed.

Although the SEC theory arose under securities law rather than cybersecurity regulation, the underlying governance logic resembles Article 20’s oversight model. The NIS2 parallel runs through Article 20 itself. A management body that approves a security programme based on information the CISO knows to be incomplete is unlikely to be able to fulfil its oversight obligation under Article 20(1).¹⁴ §38(1) BSIG goes further than Article 20(1): the final law text obliges management bodies not merely to approve but to implement the prescribed risk management measures and to oversee that implementation. Where they fail to do so, §38(2) creates a direct cause of action for damages — under company-law rules where those exist, and under the BSIG itself where they do not.

Three layers of personal liability under NIS2

The European framework that crystallised through 2025 and 2026 carries personal liability in three distinct layers, each tied to a different category of conduct.

Layer 1 — Civil damages liability

§38(2) BSIG creates a direct cause of action: management body members are personally liable to the entity for losses caused by their culpable breach of the duties in §38(1). Earlier drafts of the implementation law went further still, prohibiting the entity from waiving these damages claims by contract — but that prohibition was removed during the parliamentary process and the final law preserves the standard corporate-law framework. The personal liability itself remains statutory and direct.¹⁵ The threshold here is culpable conduct, which under German civil law begins with negligence. A management body that approved no risk management framework, that received no quarterly cybersecurity report, or that signed off on a programme it knew to be incomplete may, in many fact patterns, already have crossed the threshold.

Layer 2 — Administrative liability

Article 32(5)(b) of the directive permits competent authorities, in the most severe cases involving essential entities, to temporarily prohibit any natural person at chief executive officer or legal representative level from exercising managerial functions in that entity.¹⁶ This is the upper bound of administrative sanction and applies, by design, only to essential entities. For important entities, the parallel regime under Article 33 stops short of this measure.

Article 32(6) supplements this by requiring Member States to ensure that any natural person responsible for, or acting as the legal representative of, an essential entity has the power to ensure compliance and may be held liable for breach of those duties.¹⁷ In Germany, §65 BSIG translates failures of these obligations into administrative offences with associated fines — up to €10 million or 2% of worldwide annual turnover for essential entities, €7 million or 1.4% for important entities.

Layer 3 — Criminal liability

The directive itself does not impose criminal penalties. National law fills the gap. Knowing concealment of a reportable incident, falsification of a report submitted to the competent authority, obstruction of a supervisory process, or destruction of evidence connected to a significant incident are all conduct categories that can trigger criminal provisions under existing penal codes.¹⁸ In Germany, §263 StGB (fraud, where pecuniary damage results), §269 StGB (falsification of legally relevant electronic data), and §274 StGB (suppression of documents) all cover conduct types that intersect with NIS2 reporting obligations. In the cover-up factual pattern — paid concealment, falsified characterisation, deliberate non-disclosure to a regulator — the conduct may enter §263 territory wherever the misrepresentation produces pecuniary damage to the entity, its shareholders, or counterparties; and §269 territory wherever a falsified electronic report or record is involved.

The intent calibration: what differentiates each layer

The categorical distinction between these three layers is not arbitrary. It maps onto the subjective element of culpability — what Continental jurisprudence calls the innere Tatseite, the mental state of the actor — and that mental state determines which path liability follows.

A management body that fails to approve a Statement of Applicability, fails to schedule mandatory training under Article 20(2), or fails to register the entity with the BSI by 6 March 2026, has committed an objective breach. In most fact patterns this triggers civil damages liability under §38(2) and administrative fines under §65 BSIG. It is unlikely, on its own, to support criminal charges. The mental state is typically negligence; the response is civil and administrative.

A management body that approves a security programme it knows to be inadequate — or that receives a CISO presentation describing the programme as “in a very vulnerable state” and signs off on a public statement claiming a mature posture — may have crossed into the SolarWinds theory. The conduct may not in the end be prosecuted; the SEC’s case against the SolarWinds CISO was dismissed. But the position may no longer be defensible under Article 20(1)‘s oversight requirement. The civil damages exposure tends to widen. Where the inadequate programme is signed off in connection with a regulatory filing or supervisory process, the criminal exposure can begin.

A management body that detects a significant incident and decides, knowingly, not to report it within the 24-hour window — or that pays an attacker through a corporate channel and characterises the payment as something it is not — may be in the cover-up pattern. The civil exposure forms the floor. The administrative ban under Article 32(5)(b) is foreseeable. The criminal exposure under national law is a genuine possibility. The CSO received probation. The judge who sentenced him said the next defendant should not.

The Düsseldorf precedent: when a vulnerability becomes a governance question

On 10 September 2020, ransomware operators encrypted approximately 30 servers at the University Hospital Düsseldorf (Universitätsklinikum Düsseldorf), an essential entity in the German healthcare system affiliated with Heinrich-Heine-Universität. The hospital’s emergency department was closed. Operations were postponed. A female patient in a life-threatening condition could not be admitted and was diverted to a hospital in Wuppertal, 32 kilometres away. Treatment began roughly one hour later than it would have at Düsseldorf. She died.¹⁹

The attackers had exploited Citrix CVE-2019-19781 — a directory traversal vulnerability in Citrix ADC, Gateway, and SD-WAN WANOP products. The vulnerability had been publicly disclosed in December 2019. Patches had been available since January 2020. The Federal Office for Information Security (BSI) had issued a formal advisory in January 2020, warning of the vulnerability and the consequences of exploitation. By September, that warning was eight months old. The patch had not been applied to the relevant Düsseldorf systems. Speaking after the attack, the then-BSI President said publicly: “We warned of the vulnerability back in January and pointed out the consequences of its exploitation. Attackers gain access to internal networks and systems and can paralyse them months later. I can only urge you not to ignore or postpone such warnings.”²⁰

The case acquired a separate legal trajectory. Prosecutors in Cologne opened a preliminary investigation against the unidentified attackers on suspicion of fahrlässige Tötung — negligent manslaughter under § 222 StGB. The investigation was eventually closed without prosecution: the prosecutor could not establish direct causation between the ransomware and the patient’s death, given her underlying critical condition. The legal point survived the prosecutorial outcome. For the first documented time in Europe, a ransomware attack on a hospital had triggered a homicide-track investigation.²¹

In 2020, Düsseldorf was regulated under the KRITIS framework — the predecessor regime. KRITIS imposed obligations at the operator level, but neither as strict as those that followed nor capable of reaching the individuals who ran the institution. Above all, there was no statutory path to personal liability of the management body. The legal toolbox available in 2026 — directed at the individuals in the boardroom rather than the entity itself — did not exist in 2020.

The same factual pattern, transposed to 2026, would meet a different framework. A known critical-rated vulnerability with a patch available since January, an explicit BSI advisory in the same month, and a ransomware compromise nine months later — the gap between knowledge of risk and remediation of risk — is precisely the conduct § 38(1) BSIG addresses. Where the management body received the BSI advisory and did not commission timely remediation, the threshold for § 38(2) culpable breach may be met without further evidence. Where the patient outcome carries documentary linkage to the unpatched system, civil exposure tends to widen further. Where evidence emerges of internal acknowledgement of the risk followed by a decision not to act, the conduct may enter the SolarWinds theory. And where the decision was contemporaneously documented as a cost trade-off, the conduct may approach gross governance failure territory.

The question Düsseldorf did not have to answer in 2020 — why did the management body let a January warning sit until September? — is the question NIS2 may now make mandatory in 2026. The answer, recorded in the minutes, could become the basis of personal liability.

The view from Bonn

The BSI President, addressing the German press ahead of the law’s entry into force, stated: “NIS2 has been implemented comparatively quickly despite the change of government, and we are ready. We’re good to go.”²² The signal in the sentence is not the readiness — it is the directness. The agency that will operate the supervisory regime has positioned itself as primed to act. That is unusual rhetoric for a German regulator. It is also consistent with the trajectory of the past eighteen months: the BSI’s October 2025 position paper on the implementation law explicitly requested expanded technical powers for resilience scans, command-and-control tracking, and direct warnings to entities.

In the same interview, she went further. Asked about the practical effect of the new regime, she pointed not at the BSI’s own enforcement powers but at something else entirely:

“The big lever is not us. The big lever is the liability of managing directors, executive boards, and supervisory boards. If they cannot prove to their insurers that they have at least taken care of the basics, then, depending on the circumstances, personal liability issues may even arise that are not covered.”²³

Read that carefully. The head of the German federal cybersecurity authority is publicly stating that the most important consequence of NIS2 is not BSI fines but the personal exposure of management bodies — and that D&O insurance may not cover the gap. This is not commentary from a critic of executive culture. It is the sitting regulator explaining where the actual weight of the new regime falls. Every board in Germany should read that sentence twice.

The number that matters: around 30,000 entities now fall within the German NIS2 framework — up from approximately 4,500 under the old KRITIS regime.²⁴ By the 6 March 2026 registration deadline, BSI portal data gives the agency, for the first time, an authoritative population register against which to operate. The next eighteen months are likely to produce the first wave of administrative actions, the first §65 BSIG fines, the first §38(2) damages claims — and, in fact patterns that resemble the Uber cover-up, the first criminal investigations.

What this means for management bodies

There is a single discipline that defends against every layer of liability described in this article, and it is not a technical control. It is the integrity of the information flowing from the security function to the governance structure, and the integrity of the governance structure’s response to that information.²⁵

A board that documents its quarterly cybersecurity briefings, asks the CISO direct questions about residual risk, signs off on specific exceptions and accepts them in writing, schedules its training, and reports significant incidents within the 24-hour window has not eliminated risk.²⁶ It is likely to make the prosecutorial case against any individual member structurally harder to assemble. The CSO conviction did not turn on the breach. It turned on the documentary trail of concealment.

The mirror image is also true. A board that does not document its briefings, does not ask direct questions, signs off in silence, and authorises ambiguous responses to detected incidents is likely to assemble the prosecutorial case for any future investigator without the assistance of an attacker.

The closing

The CISO’s job in 2026 is harder than it was in 2016. The management body’s job has been fundamentally transformed.²⁷ Article 20 is not new paperwork. It is the legal architecture under which European executives are now personally accountable for what their organisation does, and does not do, when an incident is detected.

Most regulations make companies more careful about their conduct.

NIS2 makes individuals more careful.

The CSO got probation. The judge who sentenced him said the next defendant should not.²⁸

Dr. Sait Yalazay PhD / LLM / MBA

CISO — DPO — Author

CISM — CIPP — AAISM — LA 27001, 27701, 22301, 42001

Architect of Automated Compliance Systems for NIS2, GDPR, ISMS, BCM, DORA, Tisax & AI Act, NATO Cyber Security Framework

His book From Directive to Done: The 10-Step NIS2 Implementation Playbook is in print. Follow for updates.

NIS2Suite — operational compliance software built for real audits — cyberwerksuite.com

Notes