What’s the backstory here? Did an Uber competitor buy the database from a hacker? Then Uber found out which is how they found the data breach happened? Am I reading that right?
That sounds very shady whoever the competitor was.
https://www.reuters.com/article/uk-uber-tech-lyft-hacking-ex...
Reading between some lines, what Uber thinks happened is that Chris Lambert, the CTO of Lyft accessed the Github repository that had the improperly stored key (they know the IP address of the only person who they couldn't rule out and that IP was associated with Chris elsewhere online). But then the actual hack using those credentials was carried out via NordVPN so they can't be sure who actually downloaded the material.
Later on, Uber was interviewing a Lyft engineer who let them know that Lyft had a copy of the driver database, so they reverse engineered how they could have downloaded it and found their exposed credentials.
2) All the advertisement bluster in the world melts away at the arrival of the first subpoena, search warrant, or national security letter.
I'm not saying that there must be no NordVPN logs, but I am saying that if they existed and they were subpoenaed, it would be really, really surprising if Nord didn't immediately turn them over.