Uber car. Photo: Jason Doiy/ALM

Ride-sharing giant Uber violated Pennsylvania's consumer protection law when it failed to promptly disclose that a data breach occurred in late 2016, and that mistake should cost the company at least $13.5 million, state Attorney General Josh Shapiro has claimed in a newly filed lawsuit.

Shapiro filed a lawsuit Monday in the Philadelphia Court of Common Pleas, alleging that Uber violated Pennsylvania's Breach of Personal Information Notification Act when it waited more than a year to announce that it had been hacked in November 2016. According to the complaint, at least 13,500 Pennsylvania Uber drivers had their driver's license information accessed as a part of the breach.

That lawsuit follows a handful of state actions and federal actions that have also been filed over the same breach.

Along with Washington state, Illinois and the city of Chicago, which are pursuing claims under state laws, about a dozen class action suits have been filed in federal court. The federal court plaintiffs are currently pushing to have their cases consolidated into a multidistrict litigation. Since Shapiro filed Pennsylvania's suit in state court, it makes it less likely the action will be consolidated into the federal litigation.

The litigation case stems from a breach where hackers accessed the driver's license information of about 600,000 Uber drivers. According to the complaint, Uber paid the hackers $100,000 to delete the data and keep quiet about the breach. It wasn't until a year later that the company announced that a breach had taken place.

In a Nov. 21 statement, CEO Dara Khosrowshahi, who took over in August, insisted that more sensitive data like Social Security numbers, birth dates and credit card numbers hadn't been stolen. “None of this should have happened, and I will not make excuses for it,” he said. “We are changing the way we do business, putting integrity at the core of every decision we make and working hard to earn the trust of our customers.”

Pennsylvania's lawsuit said Uber had been aware of the hack as early as Nov. 14, 2016, and should have notified the drivers soon after.

“Instead of notifying impacted consumers of the breach within a reasonable amount of time, Uber hid the incident for over a year—and actually paid the hackers to delete the data and stay quiet,” Shapiro said in a press statement. “That's just outrageous corporate misconduct, and I'm suing to hold them accountable and recover for Pennsylvanians.”

Violations of the Breach of Personal Information Notification Act, according to the complaint, are deemed to be violations of the state's consumer protection law, which penalizes defendants at $1,000 for each violation, or $3,000 for each violation involving a person 60 years old or older.

Uber's chief legal officer, Tony West, said in an emailed statement that, since taking over the job three months ago, he has spoken with several state and federal regulators, as well as Shapiro's team, about the breach.

“While I was surprised by Pennsylvania's complaint this morning, I look forward to continuing the dialogue we've started as Uber seeks to resolve this matter,” he said. “While we do not in any way minimize what occurred, it's crucial to note that the information compromised did not include any sensitive consumer information such as credit card numbers or Social Security numbers, which present a higher risk of harm than driver's license numbers. I've been up front about the fact that Uber expects to be held accountable; our only ask is that Uber be treated fairly and that any penalty reasonably fit the facts.”