Why did the company wait so long to disclose the hack?
Just before Thanksgiving, news broke that Uber had been hacked, compromising 57 million users’ information. And then, on top of that, Uber then paid to cover up the incident. Dara Khosrowshahi, Uber’s new CEO, said he’d fired two employees responsible for the coverup, but that wasn’t enough to make the problem go away. Even though it happened under the previous CEO, Congress wants answers. Automotive News reports that on Monday, the heads of the Senate Commerce and Finance Committees sent a letter to Khosrowshahi asking for more information about the data breach and the subsequent cover-up.
“The company maintains that its outside forensic experts have not seen any indication that customer trip location history, credit card numbers, bank account numbers, Social Security numbers, or dates of birth were downloaded,” they said in the letter. “Nevertheless, the nature of the information currently acknowledged to have been compromised, together with the allegation that the company concealed the breach without notifying affected drivers and consumers, and prior privacy concerns at Uber, makes this a serious incident that merits further scrutiny.”
This also isn’t the first time Uber has failed to properly disclose a data breach. Back in 2016, the ride-hailing company paid a $20,000 fine for failing to disclose an incident from 2014 that left the personal information of about 50,000 drivers exposed. Following that incident, Uber was also supposed to improve its data security and do a better job protecting the privacy of the people who use its app. But clearly, it did not do enough to prevent the next breach and failed to learn its lesson.
The Senate Commerce and Finance Committees’ letter asked for a response by December 11, so we’ll likely have to wait until closer to that date to find out more. But considering Uber’s history of covering up data breaches, we’d be willing to bet regulators will be far less forgiving than they were in 2016.
Source: Automotive News (Subscription required)