On Friday, Uber accepted the responsibility for covering up a 2016 data breach that affected 57 million passengers and drivers, as part of a settlement with US prosecutors to avoid criminal charges. In joining a non-prosecution agreement, Uber admitted that its personnel failed to report the November 2016 data breach to the US Federal Trade Commission, even though the agency had been investigating the ride-sharing company’s data security.
Uber Waited a Year to Report the 2016 Data Breach
US Attorney Stephanie Hinds in San Francisco stated that Uber waited about a year to report the 2016 data breach, after installing new executive leadership who “established a strong tone from the top” regarding ethics and compliance. Hinds said the decision not to criminally charge Uber reflected new management’s prompt investigation and disclosures, and Uber’s 2018 agreement with the FTC to maintain a comprehensive privacy program for 20 years.
Furthermore, the San Francisco-based company is also cooperating with the prosecution of a former security chief, Joseph Sullivan, over his alleged role in concealing the hacking. Sullivan was originally indicted in September 2020. Prosecutors said Sullivan arranged to pay the hackers $100,000 in bitcoin and have them sign nondisclosure agreements that falsely stated they had not stolen data. Uber had a bounty program designed to reward security researchers who report flaws, but not to cover up data thefts.
In September 2018, Uber paid $148 million to settle claims by all 50 US states and Washington, DC, that it was too slow to disclose the hacking. Uber shares closed down 93 cents at $23.30 on Friday. The non-prosecution agreement was disclosed after US markets closed.
Affected Accounts Will be Flagged to Additional Fraud Protection
“While we have not seen evidence of fraud or misuse tied to the incident, we are monitoring the affected accounts and have flagged them for additional fraud protection,” Uber’s chief executive Dara Khosrowshahi said. “None of this should have happened, and I will not make excuses for it,” he added. “While I can’t erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes.”
Read more: Uber’s New Update to Stop Drivers From Canceling Rides
