Uber paid $100K to cover up 2016 data breach of 57 million users

The breach took place in October 2016 and revealed names, email addresses, phone numbers and U.S. driver's license numbers.

Uber paid to hide a data breach that revealed sensitive information on 57 million users, leading to the dismissal of Chief Security Officer Joe Sullivan.

The breach took place in October 2016 and revealed names, email addresses, phone numbers and U.S. driver’s license numbers. Social Security numbers, location data and payment data was not accessed, Uber said. The company paid the hackers $100,000 to stay quiet and delete the data. Uber has not revealed the identities of the hackers.

The breach and the payment to hackers was first reported by Bloomberg. New York Attorney General Eric Schneiderman is investigating the hack.

According to the report, hackers first breached the ridesharing company through an Uber-owned GitHub account. They found more credentials there, including usernames and passwords to an Amazon Web Services account that held rider and driver information. With the information in hand, they demanded money from the company.

“I recently learned that in late 2016 we became aware that two individuals outside the company had inappropriately accessed user data stored on a third-party cloud-based service that we use,” Uber’s CEO Dara Khosrowshahi Khosrowshahi said in a release. “The incident did not breach our corporate systems or infrastructure.”

Sullivan’s deputy, Craig Clark, has also been fired. Clark, a senior lawyer who reported to Sullivan, helped lead the incident response to the hack.

“None of this should have happened, and I will not make excuses for it,” Uber’s CEO Dara Khosrowshahi said in a release. “While I can’t erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes. We are changing the way we do business, putting integrity at the core of every decision we make and working hard to earn the trust of our customers.”

Khosrowshahi was appointed Uber CEO in September after co-founder Travis Kalanick resigned amid a flurry of criticism surrounding prolific sexual harassment issues and systemic company issues that came to public light.

Kalanick knew of the breach by November 2016, when he was still CEO but did nothing to notify regulators and users despite a legal obligation to do so.

Khosrowshahi said he’s brought on Matt Olsen, former general counsel of the National Security Agency and director of the National Counterterrorism Center, to “help me think through how best to guide and structure our security teams and processes going forward.”

The breach is not the first the ridesharing company has dealt with. In 2014, it publicly disclosed a major breach of personal data from nearly 110,000 drivers — including names, postal and email addresses, social security and driver’s license numbers.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure