Uber Paid Hackers $100,000 to Delete Stolen Data on 57 Million People

PJ Media ^ | 11-22-2017 | Michael van der Galien

[Michael van der Galien]

This week Uber fired its chief security officer and one of his deputies. The reason? They had concealed a massive security breach for more than one year. And that's not all: in order to convince the hackers to delete the information on 57 million people, the security officers paid the hackers $100,000.

"At the time of the incident, Uber was negotiating with U.S. regulators investigating separate claims of privacy violations. Uber now says it had a legal obligation to report the hack to regulators and to drivers whose license numbers were taken. Instead, the company paid hackers to delete the data and keep the breach quiet. Uber said it believes the information was never used but declined to disclose the identities of the attackers."

Dara Khosrowshahi, who became the company's CEO back in September, has published a long statement at Uber's website explaining "that in late 2016 we became aware that two individuals outside the company had inappropriately accessed user data stored on a third-party cloud-based service that we use. The incident did not breach our corporate systems or infrastructure."

Uber's outside forensics experts "have not seen any indication that trip location history, credit card numbers, bank account numbers, Social Security numbers or dates of birth were downloaded," he continued. "However, the individuals were able to download files containing a significant amount of other information."

That information includes names, email addresses, and mobile phone numbers of 57 million Uber customers around the world, and the names and driver's license numbers of 600,000 drivers in the United States.

[yldstrk]

dumb

[grey_whiskers]

Just like the laws in the financial sector, made the CEO *personally* liable for fraudulent accounting statements: make the CEO, CIO, and head of IT security, *personally* liable for any data breaches: and force them to prospectively fund any suit against them once a judge or jury has ruled by a preponderance of the evidence, that negligence or poor security practice, led to the breach.

Hey, it works for males accused of sexual harassment in college.

[grania]

dumb

What Uber has done is cut corners to out-compete established taxi businesses. They over-reached in cutting corners.

[pinkandgreenmom]

Our account was hacked. We have just received 3 charges from UberEats for McDonalds in London in the past 12 hours.

[SunkenCiv]

Uber was such a good idea for a product (people operating "gypsy cabs" had figured that out long ago), but the nimrods running it could louse up a free lunch. Thanks Michael van der Galien.

[Vaduz]

Ain’t computers grand Moe?.