Commonwealth v. Uber  Technologies

$5.7M Verdict

Date of Verdict: Sept. 26.

Court and Case No.: C.P. Philadelphia No. 180300004.

Type of Action: Data breach.

Injuries: Personal information exposed.

Plaintiffs Counsel: Timothy Murphy, Pennsylvania Office of Attorney General.

Defense Counsel: Stephen A. Loney, Hogan Lovells, Philadelphia.

Comment:

Uber has agreed to pay a record $148 million in state and local penalties to settle allegations that the company intentionally concealed a major data breach in 2016 that exposed the personal information of 57 million people, with $5.7 million going to Pennsylvania, state Attorney General Josh Shapiro's office said.

The settlement comes in the wake of a multistate investigation that found the ride-hailing company paid hackers $100,000 to conceal the breach, which exposed the names, email addresses, and cellphone numbers of those users.

Uber did not provide public notice of the breach until a year after it happened in late 2016.

The company's board of directors were in the dark about the ransom payment until it was discovered by a law firm last spring. The firm was hired to investigate the company's security team in a separate matter but stumbled on the breach during its inquiry. The board then hired a forensic firm to probe what happened with the breach.

Uber said in a November 2017 statement from CEO Dara Khosrowshahi that the breach was carried out by two hackers outside the company. The hackers accessed user data on a third-party, cloud-based service the company uses to store some information. They, however, were not able to download users' Social Security numbers, bank account information, credit card numbers, dates of birth and trip history, according to the company.

The hackers were able to collect the names, email addresses, and cellphone numbers of the 57 million people that use Uber and the driver's license numbers of about 600,000 drivers, according to the company.

Uber eventually provided notice of the breach after an investigation, but that wasn't until a year after the breach and ransom payment happened.

About $1.35 million of the $5.7 million Pennsylvania receives from the settlement will be distributed in $100 payments to the 13,500 Pennsylvania drivers affected by the breach, according to a press release by Shapiro's office.

The remaining $4.35 million of Pennsylvania's proceeds will go to the Attorney General's Public Protection Section and Bureau of Consumer Protection and, according to Shapiro's office, will “be used to conduct future investigations and outreach to protect Pennsylvanians from violations of consumer protection law.”

“The more personal information these criminals gain access to, the more vulnerable the person whose information was stolen becomes,” Shapiro said in the release. “That's why my Bureau of Consumer Protection took action, and it is why we are also continuing to lead an ongoing national investigation into the Equifax breach.”

Uber chief legal officer Tony West said in a statement on Wednesday that they are working to improve safety and security after the breach and have hired new experts to implement those improvements. He said the company learned from its mistake in 2016. “Our current management team's decision to disclose the incident was not only the right thing to do, it embodies the principles by which we are running our business today: transparency, integrity, and accountability,” West said. “An important component of living up to those principles means taking responsibility for past mistakes, learning from them, and moving forward.”

The company's notice in 2017 launched a nationwide investigation into its conduct in the wake of the breach. California is one of several states that independently investigated the breach before teaming up with other states on the probe.

The settlement is between Uber, all 50 states, and the District of Columbia.

Uber has also promised to develop a new policy on data security that will assess the potential risk of another breach and implement improvements beyond what's currently in place. The company is required to hire an outside contractor to examine its security efforts regularly and recommend improvements.

Uber will also have to take additional precautions to protect any user data it stores on third-party platforms, such as the one hackers accessed in 2016. If there is another breach, employees must also have an avenue to report any ethics concerns they have about other employees. Those employees will also now be subject to stricter password guidelines to gain access to the company's internal network.

The settlement does not resolve any liability that Uber may have to consumers, Becerra said. Uber is still litigating claims related to the breach in multidistrict litigation before U.S. District Judge Philip Gutierrez in the Central District of California.

—Dan M. Clark, of the Law Weekly