HackerOne employee stole bug reports and collected the bounties TechRadar Skip to main content TechRadar is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Here's why you can trust us. HackerOne employee stole bug reports and collected the bounties By Sead Fadilpašić last updated 4 July 2022 An insider was scooping up bug reports and presenting them as their own (Image credit: N/A) Audio player loading… An employee of bug bounty platform HackerOne has been stealing user-submitted reports and disclosing the information to the affected vendors, sometimes in exchange for financial reward. In a blog post (opens in new tab), the company revealed the details of the incident, which took place over the course of roughly three months, and confirmed that the employee has since been fired. HackerOne is still considering whether or not to pursue a criminal lawsuit, BleepingComputer reported. Identical reports raising eyebrows In early April, HackerOne brought in a new employee who, due to their position, had access to bug reports. These reports highlight vulnerabilities in various software and services that could be exploited by cybercriminals to steal passwords and other sensitive information, distribute malware and more. From early on, the individual began gathering reports, and under a fake name reaching out to the affected businesses, often in a threatening and intimidating tone, HackerOne said. The employee would then demand payment in exchange for the vulnerability disclosure, and in some instances even got their way. HackerOne was alerted to the potential fraud when one of its affected clients reached out to say that another person "discovered" an identical flaw. While duplicate discoveries in bug hunting aren't uncommon, this particular instance was identical to such an extent that it arose suspicion, the company said.Read more> Google is upping its Linux bug bounty prize (opens in new tab) > 1Password ups maximum bug bounty (opens in new tab) > Best patch management tools of 2022 (opens in new tab) Together with payment providers, HackerOne was able to follow the money, and soon discovered one of its own employees was behind the scheme. Soon after, it banned the employee from accessing the system, and remotely locked their laptop, pending investigation. The investigation showed all of the bug reports the person had accessed, prompting the company to reach out to both the hackers discovering the bugs and the companies affected. The company also said that not all of the bug reports that the person accessed were abused. In some cases, the access was for legitimate purposes.Protect your devices from bad actors with the best malware removal services right now Via BleepingComputer (opens in new tab) Sead Fadilpašić Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he's written for numerous media outlets, including Al Jazeera Balkans. He's also held several modules on content writing for Represent Communications. See more Computing news Are you a pro? Subscribe to our newsletter Sign up to theTechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Thank you for signing up to TechRadar. You will receive a verification email shortly. There was a problem. Please refresh the page and try again. MOST POPULARMOST SHARED1The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me2Stop saying Mario doesn't have an accent in The Super Mario Bros. Movie3Google Pixel Tablet is what Apple should've done ages ago4RTX 4090 too expensive? Nvidia resurrects another old favorite5More than one million credit card details leaked online1The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me2iPhone 15 tipped to come with an upgraded 5G chip3If this feature succeeds for Modern Warfare 2, Microsoft can't ignore it4Apple October launches: the new devices we might see this month5The Rings of Power episode 8 trailer feels like one big Sauron misdirect Technology Magazines (opens in new tab)● (opens in new tab)The best tech tutorials and in-depth reviewsFrom$12.99 (opens in new tab)View (opens in new tab)