My admittedly limited understanding/speculation (from what I saw disclosed in the media and the timing of the events) is that this breach came to light shortly after Dara took over as CEO (presumably from a review of finances), and that Dara then voluntarily disclosed the breach to the public as part of Uber's reputation house cleaning effort, and that the failure to disclose the breach was the reason for Joe's termination.

I don't know whether Uber had a proper bug bounty program setup at the time this happened, nor whether this could be considered one, so I can't comment on the specifics.