City, county sue Uber
Allege ride- hailing giant failed to give prompt notice of data breach, violating city code
The city of Chicago and Cook County filed a joint lawsuit against Uber on Monday, alleging the embattled ride- hailing company violated several parts of the Chicago Municipal Code and state law when it concealed that the personal information of more than 57 million drivers and customers was stolen in a hack more than a year ago.
The suit was filed Monday in Cook County Circuit Court by Chicago Corporation Counsel Ed Siskel and Cook County State’s Attorney Kim Foxx on behalf of the People of the State of Illinois.
It is alleged that Uber failed to safeguard personal information, failed to give prompt notice of a data breach and went on to conceal a data breach, all violation of the Chicago Municipal Code. The suit also states that Uber also violated the Illinois Consumer Fraud and Deceptive Business Practices Act.
Chicago Mayor Rahm Emanuel has been accused of tilting the regulatory playing field in favor of Uber, whose investors include the mayor’s brother, Hollywood super- agent Ari Emanuel.
But that didn’t stop the mayor from joining forces with Foxx in filing a consumer fraud lawsuit against the ride- hailing giant.
“Not only did Uber allow a massive data breach that exposed the personal information of millions of drivers and passengers, they brazenly attempted to conceal this information from the public,” Emanuel said in a statement. “The City of Chicago will not tolerate these kinds of irresponsible practices, which is why we are taking legal action to hold Uber accountable for their actions.”
There’s no evidence that the data taken has been misused, according to a recent blog post by Uber’s recently hired CEO, Dara Khosrowshahi. Part of the reason nothing malicious has happened is because Uber acknowledges that it paid the hackers $ 100,000 to destroy the information stolen in October 2016.
The suit seeks millions in relief and damages. The suit seeks a $ 10,000 fine “for each violation involving a Chicago resident . . . for each day such violation has existed and continues to exist.”
Additionally, the suit seeks a $ 50,000 fine against Uber for violating the Illinois Consumer Fraud and Deceptive Business Practices Act, and an additional $ 10,000 fine for every violation that involved an Illinois resident at least 65 years old.
In an email Monday, Uber spokeswoman Molly Spaeth said: “We take this matter very seriously and we are happy to answer any questions regulators may have. We are committed to changing the way we do business, putting integrity at the core of every decision we make, and working hard to re- gain the trust of consumers.”
The city and county will be represented by an outside law firm, Edelson PC, during the litigation process. Any damages awarded will go toward paying the firm, according to the city’s statement.
“By failing to secure personal and sensitive data — despite its legal obligations to do so — and then covering the breach up for over a year — despite its legal obligations to disclose the breaches — Uber willfully and intentionally exposed many Chicago and Illinois residents to the risks of identity theft and financial fraud, tax return scams, and other potential harm,” the suit states.
Uber was subject to a smaller data breach in 2014.
“After the 2014 breach, Uber agreed to make significant updates to its security practices to meet industry standards, but failed to do so,” according to a statement from the city.
Data breaches aside, Emanuel said last month that ride- hailing companies have cost the city more than $ 40 million in lost revenue.