Uber Got Hacked a Year Ago and Paid the Hackers to Keep It Secret

Uber reportedly paid the hackers $100,000 to delete the stolen data and keep quiet about it.

Grow Your Business, Not Your Inbox

Stay informed and join our daily newsletter now!
Will be used in accordance with our Privacy Policy
Uber Got Hacked a Year Ago and Paid the Hackers to Keep It Secret
Image credit: via PC Mag
Guest Writer
4 min read
This story originally appeared on PCMag

Uber is only now going public about an October 2016 data breach that affected the data of Uber drivers as well as 57 million users, exposing their names, email addresses and mobile phone numbers.

Uber's new CEO Dara Khosrowshahi said Tuesday that he only recently learned about the incident, which Uber discovered in November 2016.

"You may be asking why we are just talking about this now, a year later," wrote Khosrowshahi, who was hired in August. "I had the same question, so I immediately asked for a thorough investigation."

Uber found that "two individuals outside the company" accessed user data -- including the names and driver's license numbers of 600,000 drivers in the U.S. -- via a third-party cloud service.

"We subsequently identified the individuals and obtained assurances that the downloaded data had been destroyed," Uber's CEO wrote.

According to Bloomberg, Uber paid the hackers $100,000 to delete the data and stay quiet.

No trip location history, credit card numbers or other sensitive data like Social Security numbers were downloaded by the hackers, Khosrowshahi said. Uber is now notifying drivers affected by the breach and monitoring affected user accounts with additional fraud protection. So far, Uber has found no evidence of fraud or misuse related to the breach.

However, it's unclear why Uber didn't alert regulatory authorities. Most states, including California, have laws that demand companies disclose data breaches when they affect local residents' personal information.

"None of this should have happened, and I will not make excuses for it," according to Khosrowshahi, who fired the two people who led the company's response to the breach. That includes Uber's chief security officer Joe Sullivan, Bloomberg says.

"While I can't erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes," Khosrowshahi said.

Uber did not immediately respond to a request for comment.

Why paying hackers can be problematic

The company's decision to reportedly pay off the hackers is raising a lot of questions.

Did the hackers really delete the stolen data? Why is Uber so confident that the hackers kept their word?

"You are basically relying on the integrity of a criminal group," said security expert Vincent Weafer, vice president of McAfee Labs.

Uber's statement on Tuesday oddly indicates the company actually knows the hackers' identities. But that same statement doesn't mention anything about Uber contacting the FBI to arrest the hackers.

"It's a very unusual case," said Weafer, who pointed out that hackers can't be trusted.

For instance, many businesses are experiencing ransomware attacks from cybercrminals. These attacks will hold computer systems hostage, and demand the victims pay a ransom to free them.

However, hackers have no obligation to release the computers when paid, and can often leave the computers infected, Weafer said.

"When people have paid the money, you still never know for sure if the breach has been contained or any information has been leaked," he added. "In this case, we still don't know enough."

News of the breach is stirring up plenty of debate among security experts over Uber's handling of the situation.

Why Uber decided to keep the data breach secret is another key question. Under its previous CEO, Travis Kalanick, the company gained a nasty reputation for breaking the rules, and avoiding the authorities.

The company's new CEO, Khosrowshahi, is working to repair that reputation and making Uber more transparent. In response to the breach, he's hired a former general counsel for the U.S. National Security Agency to help Uber improve its security teams.

More from Entrepreneur

Get heaping discounts to books you love delivered straight to your inbox. We’ll feature a different book each week and share exclusive deals you won’t find anywhere else.
Jumpstart Your Business. Entrepreneur Insider is your all-access pass to the skills, experts, and network you need to get your business off the ground—or take it to the next level.
Are you paying too much for business insurance? Do you have critical gaps in your coverage? Trust Entrepreneur to help you find out.

Latest on Entrepreneur

Entrepreneur Media, Inc. values your privacy. In order to understand how people use our site generally, and to create more valuable experiences for you, we may collect data about your use of this site (both directly and through our partners). By continuing to use this site, you are agreeing to the use of that data. For more information on our data policies, please visit our Privacy Policy.