Uber Agrees to Pay $148 Million to States Over Major 2016 Data Breach
The settlement is the result of a multistate investigation that found Uber paid hackers $100,000 to conceal the breach, which exposed the names, email addresses, and cellphone numbers of those users.
September 26, 2018 at 02:16 PM
5 minute read
The original version of this story was published on New York Law Journal
Uber has agreed to pay a record $148 million penalty to settle allegations that it intentionally concealed a major data breach in 2016 that exposed the personal information of 57 million people, New York Attorney General Barbara Underwood's office said Wednesday.
The settlement comes in the wake of a multistate investigation that found the ride-hailing company paid hackers $100,000 to conceal the breach, which exposed the names, email addresses, and cellphone numbers of those users.
Uber did not provide public notice of the breach until a year after it happened in late 2016, according to a statement from Underwood's office.
The company's board of directors were in the dark about the ransom payment until it was discovered by a law firm last spring, the New York Attorney General's Office said. The firm was hired to investigate the company's security team in a separate matter but stumbled on the breach during its inquiry. The board then hired a forensic firm to probe what happened with the breach.
Uber said in a November 2017 statement from CEO Dara Khosrowshahi that the breach was carried out by two hackers outside the company. They accessed user data on a third-party, cloud-based service the company uses to store some information. The hackers were not able to download users' Social Security numbers, bank account information, credit card numbers, dates of birth, and trip history, according to the company.
They were able to collect the names, email addresses, and cellphone numbers of the 57 million people that use Uber. They were also able to obtain the driver's license numbers of about 600,000 drivers, according to Uber.
Uber eventually provided notice of the breach after an investigation, but that wasn't until a year after the breach and ransom payment happened. The incident caused the company to fire the two individuals that apparently led the company's response to the hack. Uber Chief Legal Officer Tony West said in a statement on Wednesday that they are working to improve safety and security after the breach and have hired new experts to implement those improvements. He said the company learned from its mistake in 2016. “Our current management team's decision to disclose the incident was not only the right thing to do, it embodies the principles by which we are running our business today: transparency, integrity, and accountability,” West said. “An important component of living up to those principles means taking responsibility for past mistakes, learning from them, and moving forward.”
The company's notice in 2017 launched a nationwide investigation into its conduct in the wake of the breach. New York is one of several states that independently investigated the breach before teaming up with other states on the probe.
The settlement is between Uber, all 50 states, and the District of Columbia. Under the agreement New York will receive $5.1 million. The agreement also requires Uber to take certain steps to improve security for its users in New York, where investigators negotiated additional terms to the settlement.
Uber has also promised to develop a new policy on data security that will assess the potential risk of another breach and implement improvements beyond what's currently in place. The company is required to hire an outside contractor to examine its security efforts regularly and recommend improvements.
Uber will also have to take additional precautions to protect any user data it stores on third-party platforms, such as the one hackers accessed in 2016. If there is another breach, employees must also have an avenue to report any ethics concerns they have about other employees. Those employees will also now be subject to stricter password guidelines to gain access to the company's internal network.
Wednesday's settlement resolves litigation around what was actually the second breach in recent years that Uber was faulted for failing to report in a timely manner, Underwood's office said. The company was also hacked in 2014 but did not provide notice until five months later in 2015. That breach exposed the names and driver's license numbers of about 50,000 Uber drivers.
Underwood said in a statement that the resolution should be seen as a warning to other companies who attempt to hide a data breach affecting users' personal information.
“This record settlement should send a clear message: we have zero tolerance for those who skirt the law and leave consumer and employee information vulnerable to exploitation,” Underwood said. “We'll continue to fight to protect New Yorkers from weak data security and criminal hackers.”
READ MORE:
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllTrending Stories
- 1Ed Sheeran Meets Led Zeppelin in the Second Circuit
- 2You Too Can Be a Programmer: How Generative AI Can Upskill Any E-Discovery Professional to Write Code
- 3Is Arbitration Working?
- 4New Battleground: Wall Street Law Firms Eye London Growth
- 5Standstill: Court Defers to Legislature on Texas Healthcare
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250