Uber fined $148m for attempting to hide 2016 data breach

Illinois attorney general calls the yearlong notification delay "inexcusable"

Uber will pay $148 million for failing to notify its drivers that their personal details had been hacked in 2016.

Rather than reporting it, it was discovered that Uber had attempted to hide evidence of the data breach by paying a ransom of $100,000 to ensure the stolen data would not be misused.

After a subsequent investigation, the ride-hailing firm has agreed on a settlement with all 50 states and the District of Columbia.

"This is one of the most egregious cases we've ever seen in terms of notification; a yearlong delay is just inexcusable," Lisa Madigan, the Illinois attorney general, told the Associated Press. "And we're not going to put up with companies, Uber or any other company, completely ignoring our laws that require notification of data breaches."

The breach happened in October 2016, with names, email addresses and phone numbers of around 57 million users of the service being taken, as well as driver's license data belonging to approximately 600,000 US drivers.

Travis Kalanick, then chief executive, reportedly knew about the breach for over a year. He was later forced out of the company after reports of sexism and poor working practices. Uber has made a number of management changes since the hack and Tony West, Uber's chief legal officer, said the decision by current managers to reform the company was "the right thing to do".

"It embodies the principles by which we are running our business today: transparency, integrity and accountability," West said. "An important component of living up to those principles means taking responsibility for past mistakes, learning from them, and moving forward."

For Rob Shapland, principle cybersecurity consultant at Falanx Group, Uber's hefty fine should be a warning to companies contemplating data breach coverups.

"This fine shows that companies can no longer get away with poor cybersecurity and sweeping incidents under the carpet," he said. "I would expect many companies will have tried to hide the fact that they've been breached, especially given the size of the potential fines.

"This case, and the punishment for Uber for not revealing that the breach had occurred will hopefully give companies further warning of the risks posed by cyber attacks so that they take the security of the data they hold more seriously."

The fine will be split among US states based on the number of drivers employed, according to Madigan speaking to the Associated Press. For example, Illinois is expected to get $8.5 million, with each affected driver receiving $100 each.

Featured Resources

Choosing a collaboration platform

Eight questions every IT leader should ask

Download now

Performance benchmark: PostgreSQL/ MongoDB

Helping developers choose a database

Download now

Customer service vs. customer experience

Three-step guide to modern customer experience

Download now

Taking a proactive approach to cyber security

A complete guide to penetration testing

Download now

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021
Roadmap 2021: What’s coming from 3CX
Advertisement Feature

Roadmap 2021: What’s coming from 3CX

30 Mar 2021