Uber fined $148m for attempting to hide 2016 data breach

Illinois attorney general calls the yearlong notification delay "inexcusable"

Uber will pay $148 million for failing to notify its drivers that their personal details had been hacked in 2016.

Rather than reporting it, it was discovered that Uber had attempted to hide evidence of the data breach by paying a ransom of $100,000 to ensure the stolen data would not be misused.

After a subsequent investigation, the ride-hailing firm has agreed on a settlement with all 50 states and the District of Columbia.

"This is one of the most egregious cases we've ever seen in terms of notification; a yearlong delay is just inexcusable," Lisa Madigan, the Illinois attorney general, told the Associated Press. "And we're not going to put up with companies, Uber or any other company, completely ignoring our laws that require notification of data breaches."

The breach happened in October 2016, with names, email addresses and phone numbers of around 57 million users of the service being taken, as well as driver's license data belonging to approximately 600,000 US drivers.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Travis Kalanick, then chief executive, reportedly knew about the breach for over a year. He was later forced out of the company after reports of sexism and poor working practices. Uber has made a number of management changes since the hack and Tony West, Uber's chief legal officer, said the decision by current managers to reform the company was "the right thing to do".

"It embodies the principles by which we are running our business today: transparency, integrity and accountability," West said. "An important component of living up to those principles means taking responsibility for past mistakes, learning from them, and moving forward."

For Rob Shapland, principle cybersecurity consultant at Falanx Group, Uber's hefty fine should be a warning to companies contemplating data breach coverups.

"This fine shows that companies can no longer get away with poor cybersecurity and sweeping incidents under the carpet," he said. "I would expect many companies will have tried to hide the fact that they've been breached, especially given the size of the potential fines.

"This case, and the punishment for Uber for not revealing that the breach had occurred will hopefully give companies further warning of the risks posed by cyber attacks so that they take the security of the data they hold more seriously."

Advertisement - Article continues below

The fine will be split among US states based on the number of drivers employed, according to Madigan speaking to the Associated Press. For example, Illinois is expected to get $8.5 million, with each affected driver receiving $100 each.

Featured Resources

Transform the operator experience with enhanced automation & analytics

Bring networking into the digital era

Download now

Artificially intelligent data centres

How the C-Suite is embracing continuous change to drive value

Download now

Deliver secure automated multicloud for containers with Red Hat and Juniper

Learn how to get started with the multicloud enabler from Red Hat and Juniper

Download now

Get the best out of your workforce

7 steps to unleashing their true potential with robotic process automation

Download now
Advertisement

Most Popular

Visit/security/vulnerability/354309/patch-issued-for-critical-windows-bug
vulnerability

Patch issued for critical Windows bug

11 Dec 2019
Visit/hardware/354193/buy-it-to-grow-not-slow-your-business
Sponsored

Buy IT to grow, not slow, your business

25 Nov 2019
Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/security/antivirus/354328/microsoft-to-scrap-security-essentials-when-windows-7-reaches-end-of-life
antivirus

Microsoft to scrap Security Essentials when Windows 7 reaches end-of-life

13 Dec 2019