Uber Got Hacked a Year Ago and Paid the Hackers to Keep It Secret

Uber reportedly paid the hackers $100,000 to delete the stolen data and keep quiet about it.
Uber Got Hacked a Year Ago and Paid the Hackers to Keep It Secret
Image credit: via PC Mag

Grow Your Business, Not Your Inbox

Stay informed and join our daily newsletter now!
4 min read
This story originally appeared on PCMag

Uber is only now going public about an October 2016 data breach that affected the data of Uber drivers as well as 57 million users, exposing their names, email addresses and mobile phone numbers.

Uber's new CEO Dara Khosrowshahi said Tuesday that he only recently learned about the incident, which Uber discovered in November 2016.

"You may be asking why we are just talking about this now, a year later," wrote Khosrowshahi, who was hired in August. "I had the same question, so I immediately asked for a thorough investigation."

Uber found that "two individuals outside the company" accessed user data -- including the names and driver's license numbers of 600,000 drivers in the U.S. -- via a third-party cloud service.

"We subsequently identified the individuals and obtained assurances that the downloaded data had been destroyed," Uber's CEO wrote.

According to Bloomberg, Uber paid the hackers $100,000 to delete the data and stay quiet.

No trip location history, credit card numbers or other sensitive data like Social Security numbers were downloaded by the hackers, Khosrowshahi said. Uber is now notifying drivers affected by the breach and monitoring affected user accounts with additional fraud protection. So far, Uber has found no evidence of fraud or misuse related to the breach.

However, it's unclear why Uber didn't alert regulatory authorities. Most states, including California, have laws that demand companies disclose data breaches when they affect local residents' personal information.

"None of this should have happened, and I will not make excuses for it," according to Khosrowshahi, who fired the two people who led the company's response to the breach. That includes Uber's chief security officer Joe Sullivan, Bloomberg says.

"While I can't erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes," Khosrowshahi said.

Uber did not immediately respond to a request for comment.

Why paying hackers can be problematic

The company's decision to reportedly pay off the hackers is raising a lot of questions.

Did the hackers really delete the stolen data? Why is Uber so confident that the hackers kept their word?

"You are basically relying on the integrity of a criminal group," said security expert Vincent Weafer, vice president of McAfee Labs.

Uber's statement on Tuesday oddly indicates the company actually knows the hackers' identities. But that same statement doesn't mention anything about Uber contacting the FBI to arrest the hackers.

"It's a very unusual case," said Weafer, who pointed out that hackers can't be trusted.

For instance, many businesses are experiencing ransomware attacks from cybercrminals. These attacks will hold computer systems hostage, and demand the victims pay a ransom to free them.

However, hackers have no obligation to release the computers when paid, and can often leave the computers infected, Weafer said.

"When people have paid the money, you still never know for sure if the breach has been contained or any information has been leaked," he added. "In this case, we still don't know enough."

News of the breach is stirring up plenty of debate among security experts over Uber's handling of the situation.

Why Uber decided to keep the data breach secret is another key question. Under its previous CEO, Travis Kalanick, the company gained a nasty reputation for breaking the rules, and avoiding the authorities.

The company's new CEO, Khosrowshahi, is working to repair that reputation and making Uber more transparent. In response to the breach, he's hired a former general counsel for the U.S. National Security Agency to help Uber improve its security teams.

More from Entrepreneur

We created the SYOB course to help you get started on your entrepreneurial journey. You can now sign up for just $99, plus receive a 7-day free trial. Just use promo code SYOB99 to claim your offer.
Jumpstart Your Business. Entrepreneur Insider is your all-access pass to the skills, experts, and network you need to get your business off the ground—or take it to the next level.
From business to marketing, sales, design, finance, and technology, we have the top 3 percent of Experts ready to work for you. Join the future of work and learn more about our Expert solutions!

Latest on Entrepreneur