Uber sued over breach after paying hackers to keep quiet.
Two lawsuit sand a federal probe result from compromise of 57M customers’ and drivers’ data
SAN FRANCISCO >> Uber’s admission that it took more than a year to disclose the theft of personal data from 57 million customers and drivers has now drawn two lawsuits and a federal probe.
Compounding the ride-hailing titan’s woes are news reports that it paid the hackers $100,000 to destroy the pilfered data, and that its new CEO knew about the breach for more than two months before revealing it to customers and drivers.
The hack and its fallout are just the latest problems to strike a firm that is already a target for harsh criticism about its management — from claims it fostered a reckless, misogynist company culture that led to sexual harassment and bullying, to revelations about use of secret technology for evading authorities’ oversight, to a trade-secrets lawsuit by Google self-driving spinoff Waymo, and an $8.9 million fine levied Monday by Colorado over drivers with serious criminal and driving-infraction records.
The beleaguered San Francisco company’s latest personal-data trouble started in October 2016, when hackers broke into its systems and downloaded names, email addresses and cell phone numbers of 57 million Uber customers, along with names and driver’s license numbers of some 600,000 U.S. Uber drivers, according to statements from the company.
Such information is commonly used for identity theft, which can result in criminals obtaining credit cards and loans in victims’ names, or looting their bank accounts.
It wasn’t until Tuesday that Uber, in a statement from CEO Dara Khosrowshahi, revealed the breach to customers, drivers and the public. And according to a new report, Khosrowshahi had learned of the hack two weeks after he took the reins of the company Sept. 5, according to the Wall Street Journal, which cited
unnamed people said to be familiar with the matter.
In his Tuesday statement disclosing the 2016 hack, Khosrowshahi said he had “recently” learned of it.
The breach, and Uber’s response to it, drew two lawsuits soon after the company announced it had been hacked. Both suits seek class-action status.
On Tuesday, Alejandro Flores of Los Angeles launched a suit on behalf of himself and people who were Uber customers or drivers at the time of the breach. The legal action takes aim at the gap of more than a year between Uber’s discovery of the hack and its public disclosure.
“Customers, and drivers had no chance to protect their identity and their information,” said the suit filed in Central District of California U.S. District Court.
Flores also claims credit card and Social Security numbers were stolen, along with dates of birth. If true,
that would put customers and drivers at increased risk of identity theft and fraud.
Khosrowshahi had said in his statement that the company’s “outside forensic experts” found no indication that dates of birth, or credit card or Social Security numbers were taken.
Uber did not immediately respond to a question about whether those types of data were stolen, or to additional questions about the breach and the company’s response. The lawyers representing Flores did not immediately respond to a request for information about the claims of stolen birth dates and credit card and Social Security numbers.
The other lawsuit, filed Wednesday by Danyelle Townsend and Ken Tew, highlights an allegation in a Nov. 21 Bloomberg report that Uber — under previous CEO Travis Kalanick — had paid the hackers to delete the stolen data and keep quiet about it.
“Rather than alerting regulators, law enforcement and victims of the Data Breach, Uber sought to conceal the Data Breach
by paying the hackers $100,000 to destroy the stolen data and to promise to keep the Data Breach secret from the public and regulators,” the suit filed in Northern California U.S. District Court said.
This legal action also includes claims about personal data beyond what Uber has admitted was stolen.
“Also potentially at risk are additional pieces of personally identifiable information generally available in Uber customer accounts including: location history, credit card numbers, bank account numbers, Social Security Numbers, dates of birth and other information,” the suit claims.
Fallout from the hack goes beyond the courts. The Federal Trade Commission said it was “closely evaluating the serious issues raised” by the breach, Reuters reported Wednesday.
The huge hack is not the first data-security issue to put Uber into authorities’ sights. In August, the FTC announced that it had reached a settlement with Uber after a hacker accessed names and driver’s license numbers of more than 100,000 drivers in 2014. Uber had failed to take “reasonable, low-cost measures” to properly secure its database, the FTC said. In the settlement, Uber agreed to 20 years of independent audits to certify it had an effective privacy program.
That data breach also led to a settlement between Uber and New York’s attorney general, which included a $20,000 fine for failing to provide drivers and authorities with timely notice of the hack.
The legal and regulatory problems come as Uber readies itself to go public in 2019, and negotiates with SoftBank over a multi-billion-dollar investment that would give the Japanese tech titan a 14 percent to 20 percent stake in Uber, which is valued at nearly $70 billion.
Although Uber waited until this week to publicly disclose the massive breach of customer and driver data, it told SoftBank about the hack about three weeks earlier, according to the Wall Street Journal.