Last year, the Department of Justice sent shockwaves through corporate America by criminally prosecuting former Uber security chief Joseph Sullivan for his handling of a 2016 data breach at the ride-sharing company.

It was the first time an executive had faced criminal charges for mishandling a data breach—raising fears among cybersecurity professionals that their career track now puts them at risk of landing in prison.