Uber CISO: There was no justification for hiding data breach

Senators slam taxi firm for cover-up of hack affecting 57 million people

Uber's CISO yesterday admitted that there was "no justification" for covering up a huge data breach affecting millions of customers and drivers.

The breach, which was first reported in November last year, exposed the personal information of 57 million users, including 2.7 million in the UK, as well as the license numbers of roughly 600,000 drivers.

Uber's John Flynn told US lawmakers at a Senate hearing yesterday that the company made an error in not disclosing the intrusion to the authorities and to its customers, saying: "We made a misstep in not reporting to consumers, and I think we made a misstep in not reporting to law enforcement."

Advertisement - Article continues below

Rather than report the breach, Uber paid one of the two hackers responsible $100,000 to keep the breach under wraps and to not leak the stolen data.

Senators also noted that while Uber was covering this breach up, it was in the midst of negotiations with the Federal Trade Commission over a settlement for an earlier data breach.

The money was delivered through a bug bounty programme - a framework usually used to reward ethical hackers for reporting flaws to companies rather than exploiting them. Flynn acknowledged in his testimony that this use of the bug bounty programme was 'inappropriate'.

Advertisement - Article continues below

"We recognise that the bug bounty programme is not an appropriate vehicle for dealing with intruders who seek to extort funds from the company," he said. "The approach that these intruders took was separate and distinct from those of the researchers in the security community for whom bug bounty programs are designed."

Advertisement - Article continues below

Legislators slammed Uber over its conduct, calling its actions "morally wrong and legally reprehensible".

"There ought to be no question here that Uber's payment of this blackmail without notifying consumers who were greatly at risk was morally wrong and legally reprehensible and violated not only the law but the norm of what should be expected," said Democratic senator Richard Blumenthal.

"The fact that the company took approximately a year to notify impacted users raises red flags within this committee as to what systemic issues prevented such time-sensitive information from being made available to those left vulnerable," added Republican and Senate panel chairman senator Jerry Moran.

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now



10 quick tips to identifying phishing emails

16 Mar 2020
mergers and acquisitions

Panda Security to be acquired by WatchGuard

9 Mar 2020
Business strategy

Uber, WeWork cause SoftBank to lose 99% of quarterly profit

12 Feb 2020
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019

Most Popular

Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020
video conferencing

Zoom beams iOS user data to Facebook for targeted ads

27 Mar 2020
high-performance computing (HPC)

IBM dedicates supercomputing power to coronavirus research

24 Mar 2020

These are the companies offering free software during the coronavirus crisis

25 Mar 2020