Ubiquiti data theft and extortion by insider with cloud admin credentials
In December 2020 a senior Ubiquiti developer used his own administrative access to the company's AWS and GitHub environments to steal gigabytes of confidential data, then posed as an outside hacker and demanded 50 bitcoin. Ubiquiti told customers on January 11, 2021 to change passwords after unauthorized access to systems hosted by a third-party cloud provider. Federal prosecutors charged the employee in December 2021.
- Victim
- Ubiquiti
- Industry
- Technology
- Country
- United States
- Intrusion began
- Dec 2020
- First disclosed
- Jan 11, 2021
- Actor
- Nickolas Sharp (former employee) (Insider)
- Initial access
- Insider misuse
- Identity control that failed
- Authorization
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Broad standing admin access to cloud and code repositories in a single person's hands is the risk; just-in-time elevation and alerting on bulk cloning and log tampering would have exposed the theft.
Regulatory and legal outcome
Sharp was charged in December 2021, pleaded guilty in February 2023, and was sentenced on May 10, 2023 to six years in prison and ordered to pay $1,590,487 in restitution.
Sources
- Ex-Ubiquiti dev-turned-extortionist gets 6 years in prison, The Register, May 12, 2023
- Former Ubiquiti employee charged with hacking and extorting company, The Record, Dec 1, 2021
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Coinbase customer data stolen through paid overseas support staff 2025 · Insider misuse
- Cash App Investing reports downloaded by former employee 2022 · Insider misuse
- Cyberhaven Chrome extension hijacked through OAuth consent phishing 2024 · Consent phishing
- LAPSUS$ access to Okta support via Sitel engineer workstation 2022 · Third-party access
Cite this record
SWI Community Team. (2026). Ubiquiti data theft and extortion by insider with cloud admin credentials. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2021-ubiquiti-insider-cloud-credentials/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.