IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Uber CISO: There was no justification for hiding data breach

Senators slam taxi firm for cover-up of hack affecting 57 million people

Uber's CISO yesterday admitted that there was "no justification" for covering up a huge data breach affecting millions of customers and drivers.

The breach, which was first reported in November last year, exposed the personal information of 57 million users, including 2.7 million in the UK, as well as the license numbers of roughly 600,000 drivers.

Uber's John Flynn told US lawmakers at a Senate hearing yesterday that the company made an error in not disclosing the intrusion to the authorities and to its customers, saying: "We made a misstep in not reporting to consumers, and I think we made a misstep in not reporting to law enforcement."

Rather than report the breach, Uber paid one of the two hackers responsible $100,000 to keep the breach under wraps and to not leak the stolen data.

Senators also noted that while Uber was covering this breach up, it was in the midst of negotiations with the Federal Trade Commission over a settlement for an earlier data breach.

The money was delivered through a bug bounty programme - a framework usually used to reward ethical hackers for reporting flaws to companies rather than exploiting them. Flynn acknowledged in his testimony that this use of the bug bounty programme was 'inappropriate'.

"We recognise that the bug bounty programme is not an appropriate vehicle for dealing with intruders who seek to extort funds from the company," he said. "The approach that these intruders took was separate and distinct from those of the researchers in the security community for whom bug bounty programs are designed."

Legislators slammed Uber over its conduct, calling its actions "morally wrong and legally reprehensible".

"There ought to be no question here that Uber's payment of this blackmail without notifying consumers who were greatly at risk was morally wrong and legally reprehensible and violated not only the law but the norm of what should be expected," said Democratic senator Richard Blumenthal.

"The fact that the company took approximately a year to notify impacted users raises red flags within this committee as to what systemic issues prevented such time-sensitive information from being made available to those left vulnerable," added Republican and Senate panel chairman senator Jerry Moran.

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

Uber secures 30-month licence to operate in London
Policy & legislation

Uber secures 30-month licence to operate in London

28 Mar 2022
Senate report slams agencies for poor cyber security
cyber security

Senate report slams agencies for poor cyber security

3 Aug 2021
Most employees put their workplace at risk by taking cyber security shortcuts
cyber security

Most employees put their workplace at risk by taking cyber security shortcuts

27 Jul 2021
61% of organizations say improving security a top priority for 2021
cyber security

61% of organizations say improving security a top priority for 2021

29 Jun 2021

Most Popular

Windows Server admins say latest Patch Tuesday broke authentication policies
Server & storage

Windows Server admins say latest Patch Tuesday broke authentication policies

12 May 2022
Russian hackers declare war on 10 countries after failed Eurovision DDoS attack
hacking

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack

16 May 2022
IT admin deletes company’s databases and is jailed for seven years
Policy & legislation

IT admin deletes company’s databases and is jailed for seven years

16 May 2022