Uber needs to accept responsibility and live with their mistake.
"Intruders"? Uber gave their permission when they uploaded the key to a public service (...a key to a publicly accessible database, nonetheless). Doesn't matter if it was accidental...Uber doesn't have the right to inconvenience another company (GitHub) with a subpoena because of their own mistake.