British, Dutch regulators fine Uber over data breach
British and Dutch regulators yesterday fined ride-hailing service Uber Technologies Inc for failing to protect customers’ personal information during a 2016 cyber attack involving millions of users.
Names, mobile phone numbers and email addresses were compromised in the breach, which involved 57 million users worldwide.
That included 2.7 million user accounts in Britain, representing the vast majority of people using the ride-hailing service in the country.
The Information Commissioner’s Office (ICO) in Britain fined the company £385,000 ($490,760) while the Dutch Data Protection Authority (DPA) imposed €600,000 ($678,780) fine.
“This was not only a serious failure of data security on Uber’s part, but a complete disregard for the customers and drivers whose personal information was stolen,” ICO director of investigations Steve Eckersley said in a statement.
“At the time, no steps were taken to inform anyone affected by the breach, or to offer help and support. That left them vulnerable.”
The ICO also said that the records of almost 82,000 drivers based in the UK — which included details of journeys made and how much they were paid — were also taken during the incident in October and November 2016.
The breach occurred before the introduction of the General Data Protection Regulation (GDPR) earlier this year, which would empower the ICO to issue fines up to £17 million or 4% of a company’s global turnover.
Uber, which has also faced licensing problems in London and a long-running legal battle over workers’ rights for its British drivers, said it had changed data practices since 2016 and this year hired a chief privacy officer and data protection officer.
“We’re pleased to close this chapter on the data incident from 2016,” Uber said in a statement.
“As we shared with European authorities during their investigations, we’ve made a number of technical improvements to the security of our systems both in the immediate wake of the incident as well as in the years since.”
The breach affected 174,000 people in the Netherlands and the Dutch DPA said it was fining Uber for failing to report the incident within 72 hours of its discovery.
Uber said on Nov 14 that its net loss topped a billion dollars in the recently ended quarter as it pumped money into bikes, scooters, freight and food delivery.
While a private company, Uber has taken to sharing quarterly earnings figures as it prepares for a keenly-anticipated debut on the stock market next year.
Figures released by Uber showed the San Francisco-based company lost $1.1 billion on revenue that grew to $3 billion, while overall bookings notched up to $12.7 billion.
“We had another strong quarter for a business of our size and global scope,” Uber chief financial officer Nelson Chai said in a statement shared along with the earnings figures.
“As we look ahead to an IPO and beyond, we are investing in future growth across our platform, including in food, freight, electric bikes and scooters, and high-potential markets in India and the Middle East.”