In January 2021, Ubiquiti disclosed a breach and blamed a third-party cloud provider. By March, an employee had gone further, telling journalists the incident was worse than reported. Now federal prosecutors in the Southern District of New York allege the second narrative was just as constructed as the first—and that a senior developer, Nicholas Sharp, authored both the theft and the cover-up.
What the indictment alleges
Charging documents show Sharp used privileged access to Ubiquiti's AWS cloud infrastructure and GitHub accounts over roughly two weeks in late December 2020, exfiltrating around 155 internal databases. When colleagues flagged the unusual activity on December 28, the downloads had been routed through a Surfshark VPN to obscure their origin.
Prosecutors say Sharp had earlier reduced AWS user-activity log retention to a single day, limiting the forensic trail investigators would later depend on.
A more striking detail: Sharp was simultaneously a member of the internal incident-response team, according to the indictment. He helped assess the scope of the very breach he allegedly initiated—while concealing his involvement.
Investigators traced the exfiltration to Sharp's work laptop after his VPN connection faltered multiple times during download sessions, briefly revealing his actual IP address as the source.
Why it matters
This case reframes the insider-threat problem. Sharp did not rely on nation-state tooling or zero-day exploits. His edge was positional: privileged access plus a seat at the investigation table. He could influence the post-mortem while the truncated logs spoke only so loudly.
The financial fallout highlights the compounding risk. When misleading articles ran in late March 2021, Ubiquiti's share price fell roughly 20% across two trading days, erasing over $4 billion in market value. The stock dropped on a narrative Sharp allegedly planted—not on confirmed damages.
Who should care
| Stakeholder | Primary concern |
|---|---|
| Platform engineers | Dual-role access (IR + prod) enables evidence manipulation |
| Security leads | Logs editable by the responder are not reliable forensics |
| Executives | Breach statements may reflect the insider's framing, not the facts |
| Legal/compliance | "Whistleblower" tips warrant the same scrutiny as any other tip |
What to watch next
Sharp has pleaded not guilty. The case will hinge on VPN session metadata, AWS access timestamps, and whether prosecutors can connect Sharp's conduct directly to a January 7 ransom note offering to destroy stolen data for 50 bitcoin (roughly $1.9 million at the time). A conviction would clarify how courts treat insiders who weaponize the press cycle. Until then, the operational line for engineering leaders is uncomfortable but direct: treat the person investigating the breach as a potential attack surface.
Key takeaways
- Insider risk and cloud-config risk are not separate problems—one enables the other.
- Logs the responder can edit are not evidence.
- Separate production access from incident-response tooling; use a break-glass role with independent oversight.
- Vendor breach statements deserve scrutiny, especially when an employee later contradicts them.
- Offboarding protocols must cover credential rotation for anyone with AWS or code-repository admin rights.
Frequently asked questions
What did Ubiquiti say originally?
In January 2021, the company said a third-party cloud provider had been breached and that customer account credentials were exposed.
Who is Nicholas Sharp, and what does the indictment allege?
Prosecutors describe him as a senior developer who allegedly abused privileged AWS and GitHub access to download proprietary data, then sent a ransom note demanding 50 bitcoin while simultaneously investigating the breach he allegedly caused.
How did investigators link the downloads to Sharp?
His Surfshark VPN connection dropped several times during downloads, briefly exposing his real IP address as the source. Those interruptions occurred on his work laptop, which investigators tied to the exfiltration.
What were the ransom terms?
A January 7 email demanded 50 bitcoin total, worth roughly $1.9 million at the time, split between two payments and a promise not to publish the stolen data.
What charges does Sharp face?
Four counts, including intentional damage to a protected computer, transmission of interstate communications with intent to extort, and false statements to the FBI.