The company did not disclose the cyber attack for a year. In September 2018, Uber paid $148 million to settle claims by all 50 U.S. states and Washington, D.C., that it was too slow to disclose the hacking. In July, Uber accepted responsibility for covering up the cyber security incident and agreed to cooperate with the prosecution of Joseph Sullivan over his alleged role in concealing the hacking, as part of a settlement with U.S. prosecutors to avoid criminal charges. Joseph Sullivan was originally indicted in September 2020. Prosecutors had said at the time he arranged to pay the hackers $100,000 in bitcoin and had sign nondisclosure agreements that falsely stated they had not stolen data. Joseph Sullivan was accused of withholding information from Uber officials who could have disclosed the breach to the FTC, which had been evaluating the San Francisco-based company's data security following a 2014 breach.