Ubiquiti's 'catastrophic breach' was its own engineer's 50-bitcoin extortion plot

On January 10-11, 2021, Ubiquiti emailed customers that an unauthorized party had accessed 'information technology systems hosted by a third party cloud provider' and that it could not be certain customer data — names, emails, one-way-encrypted passwords, addresses and phone numbers — had not been exposed. The email contained typos, so many recipients assumed it was phishing, and the company had to confirm its authenticity on its community forum. Shares fell, and Germany's BSI advised users to change their credentials.

On March 30, 2021, Ubiquiti followed up: the attacker had accessed its AWS-hosted servers holding source code and IT credentials, though customer data 'was not the target'; all users were urged to reset passwords and enable two-factor authentication. That same week, an anonymous 'whistleblower' told security reporters the breach was catastrophic and being covered up. Ubiquiti's stock fell from $376.78 to $298.30 — about 20% — in two days.

The plot came apart on December 1, 2021, when federal prosecutors in Manhattan indicted Nickolas Sharp, a Ubiquiti engineer. After applying for another job in December 2020, he allegedly used his own admin VPN credentials to download gigabytes from the company's AWS and GitHub accounts, applied AWS policies to limit logging, and deleted his VPN session history — but a fleeting connection drop leaked his home IP address. He was the anonymous 'hacker' who demanded 50 bitcoin by January 10, 2021, and, when refused, leaked data and posed as the whistleblower.

Stock fell from $377 to $298 in two days; Germany's BSI told customers to change passwords; a defamation suit and a press retraction followed.

One engineer's legitimate admin credentials reached everything — source code, cloud stores and security settings — with no insider guardrails between an employee and the crown jewels.

Logging was not immutable: Sharp limited it with AWS policies and wiped his VPN history, so the company could not establish what had actually happened.

The company disclosed before it could characterize the incident, and its typo-filled 'may have been accessed' email read like phishing — the vacuum invited the attacker's narrative.

An insider with admin credentials is a bigger threat than any hacker. Keep logs immutable, fence off admin access, and establish facts before disclosing — a vacuum gets filled by whoever lies loudest.

Sharp was arrested December 1, 2021, charged with stealing data and extorting his own employer; prosecutors said his manipulation of news coverage had wiped billions off the company's market value. In August 2022, security blogger Brian Krebs published a retraction and apologized — his 'whistleblower' source had been the perpetrator — and Ubiquiti's defamation suit against him settled out of court that September. The episode became a standard reference for two controls no security program should skip: immutable audit logging and privileged-access limits for insiders.