Credit: Diego M. Radzinschi / ALM

Uber Technologies Inc. failed to notify 57 million users that their data was exposed in a breach, according to a company blog post published Tuesday, which was confirmed by a source close to the matter.

As a result, two employees tasked with handling the response process have left the company, including Uber in-house attorney Craig Clark, who reported to the company's chief security officer, an article from Bloomberg said. The employees reportedly played roles in keeping the breach quiet, which, according to Bloomberg, “included a $100,000 payment to the attackers.”

An Uber spokesperson pointed Corporate Counsel to the company blog post when reached for comment. Clark himself did not immediately respond to a request for comment about his departure.

The employees' exits stemmed from an October 2016 attack that compromised personal information of 57 million users, including names, email addresses and cell phone numbers, according to the blog post. Additionally, the names and U.S. driver's license numbers of some 600,000 Uber drivers were accessed.

“None of this should have happened, and I will not make excuses for it,” Uber CEO Dara Khosrowshahi wrote in the post. “While I can't erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes. We are changing the way we do business, putting integrity at the core of every decision we make and working hard to earn the trust of our customers.”

Part of learning from the company's mistakes seems to include parting ways with the two employees involved in response efforts. This includes former chief security officer Joe Sullivan, who was reportedly asked by Khosrowshahi to resign, and in-house attorney Clark, who worked under Sullivan and was fired, according to Bloomberg.

Clark was Uber's legal director, security and law enforcement, according to his LinkedIn profile.

He joined Uber in December 2015. He worked at Facebook Inc. as an associate general counsel from 2009 to 2015 before briefly stepping into the role of general counsel with financial services startup Uphold Inc. for a few months prior to his arrival at Uber, his profile said. Before going in-house, Clark worked as an associate with White & Case for six years.

Sullivan, for his part, served as chief security officer at Uber since April 2015, according to his LinkedIn profile. Sullivan came to Uber after working as an associate GC at Facebook for about a year and then stepping into the CSO role with the company for more than five years. He also held positions at PayPal Holdings Inc. and eBay Inc.

This news comes as Tony West, who did not respond to request for comment for this story, is slated to take over for Salle Yoo as Uber's chief legal officer. Bloomberg reported that West is due to step into the role on Wednesday.

In Khosrowshahi's post, he said he has called on Matt Olsen, a co-founder of cybersecurity consulting firm called IronNet Cybersecurity–formerly of the National Security Agency and the U.S. Department of Justice–“to help me think through how best to guide and structure our security teams and processes going forward.” Uber is also notifying the relevant regulatory authorities, Khosrowshahi wrote.

Following news of the breach, New York Attorney General Eric Schneiderman's office opened an investigation into the 2016 breach, according to office press secretary Amy Spitalnick.

This story has been updated to include information about Schneiderman's investigation as well as the reported payment to attackers.

 

 

Credit: Diego M. Radzinschi / ALM

Uber Technologies Inc. failed to notify 57 million users that their data was exposed in a breach, according to a company blog post published Tuesday, which was confirmed by a source close to the matter.

As a result, two employees tasked with handling the response process have left the company, including Uber in-house attorney Craig Clark, who reported to the company's chief security officer, an article from Bloomberg said. The employees reportedly played roles in keeping the breach quiet, which, according to Bloomberg, “included a $100,000 payment to the attackers.”

An Uber spokesperson pointed Corporate Counsel to the company blog post when reached for comment. Clark himself did not immediately respond to a request for comment about his departure.

The employees' exits stemmed from an October 2016 attack that compromised personal information of 57 million users, including names, email addresses and cell phone numbers, according to the blog post. Additionally, the names and U.S. driver's license numbers of some 600,000 Uber drivers were accessed.

“None of this should have happened, and I will not make excuses for it,” Uber CEO Dara Khosrowshahi wrote in the post. “While I can't erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes. We are changing the way we do business, putting integrity at the core of every decision we make and working hard to earn the trust of our customers.”

Part of learning from the company's mistakes seems to include parting ways with the two employees involved in response efforts. This includes former chief security officer Joe Sullivan, who was reportedly asked by Khosrowshahi to resign, and in-house attorney Clark, who worked under Sullivan and was fired, according to Bloomberg.

Clark was Uber's legal director, security and law enforcement, according to his LinkedIn profile.

He joined Uber in December 2015. He worked at Facebook Inc. as an associate general counsel from 2009 to 2015 before briefly stepping into the role of general counsel with financial services startup Uphold Inc. for a few months prior to his arrival at Uber, his profile said. Before going in-house, Clark worked as an associate with White & Case for six years.

Sullivan, for his part, served as chief security officer at Uber since April 2015, according to his LinkedIn profile. Sullivan came to Uber after working as an associate GC at Facebook for about a year and then stepping into the CSO role with the company for more than five years. He also held positions at PayPal Holdings Inc. and eBay Inc.

This news comes as Tony West, who did not respond to request for comment for this story, is slated to take over for Salle Yoo as Uber's chief legal officer. Bloomberg reported that West is due to step into the role on Wednesday.

In Khosrowshahi's post, he said he has called on Matt Olsen, a co-founder of cybersecurity consulting firm called IronNet Cybersecurity–formerly of the National Security Agency and the U.S. Department of Justice–“to help me think through how best to guide and structure our security teams and processes going forward.” Uber is also notifying the relevant regulatory authorities, Khosrowshahi wrote.

Following news of the breach, New York Attorney General Eric Schneiderman's office opened an investigation into the 2016 breach, according to office press secretary Amy Spitalnick.

This story has been updated to include information about Schneiderman's investigation as well as the reported payment to attackers.