Uber fined $148m for attempting to hide 2016 data breach

Illinois attorney general calls the yearlong notification delay "inexcusable"

Uber will pay $148 million for failing to notify its drivers that their personal details had been hacked in 2016.

Rather than reporting it, it was discovered that Uber had attempted to hide evidence of the data breach by paying a ransom of $100,000 to ensure the stolen data would not be misused.

After a subsequent investigation, the ride-hailing firm has agreed on a settlement with all 50 states and the District of Columbia.

"This is one of the most egregious cases we've ever seen in terms of notification; a yearlong delay is just inexcusable," Lisa Madigan, the Illinois attorney general, told the Associated Press. "And we're not going to put up with companies, Uber or any other company, completely ignoring our laws that require notification of data breaches."

The breach happened in October 2016, with names, email addresses and phone numbers of around 57 million users of the service being taken, as well as driver's license data belonging to approximately 600,000 US drivers.

Travis Kalanick, then chief executive, reportedly knew about the breach for over a year. He was later forced out of the company after reports of sexism and poor working practices. Uber has made a number of management changes since the hack and Tony West, Uber's chief legal officer, said the decision by current managers to reform the company was "the right thing to do".

"It embodies the principles by which we are running our business today: transparency, integrity and accountability," West said. "An important component of living up to those principles means taking responsibility for past mistakes, learning from them, and moving forward."

For Rob Shapland, principle cybersecurity consultant at Falanx Group, Uber's hefty fine should be a warning to companies contemplating data breach coverups.

"This fine shows that companies can no longer get away with poor cybersecurity and sweeping incidents under the carpet," he said. "I would expect many companies will have tried to hide the fact that they've been breached, especially given the size of the potential fines.

"This case, and the punishment for Uber for not revealing that the breach had occurred will hopefully give companies further warning of the risks posed by cyber attacks so that they take the security of the data they hold more seriously."

The fine will be split among US states based on the number of drivers employed, according to Madigan speaking to the Associated Press. For example, Illinois is expected to get $8.5 million, with each affected driver receiving $100 each.

Featured Resources

Four cyber security essentials that your board of directors wants to know

The insights to help you deliver what they need

Download now

Data: A resource much too valuable to leave unprotected

Protect your data to protect your company

Download now

Improving cyber security for remote working

13 recommendations for security from any location

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

Most Popular

Cisco acquires container security startup Banzai Cloud
Security

Cisco acquires container security startup Banzai Cloud

18 Nov 2020
macOS Big Sur is bricking some older MacBooks
operating systems

macOS Big Sur is bricking some older MacBooks

16 Nov 2020
46 million Animal Jam accounts leaked after comms software breach
Security

46 million Animal Jam accounts leaked after comms software breach

13 Nov 2020