Uber Caught Trying to Hide Massive Data Breach

Kerry Lear

8 years ago

The technology and logistics company, Uber has been caught attempting to conceal an October 2016 data breach that exposed 57 million peoples&rsquo&semi; personal information&period;&NewLine;First reported by Bloomberg, the company paid 100,000 to two hackers after they stole the company&rsquo&semi;s customer data in exchange for their silence and the deletion of the stolen information&period; &nbsp&semi;&NewLine;&ldquo&semi;A big part of the shock and disappointment comes from the fact that Uber appears to have paid hush money to keep this under wraps,&rdquo&semi; said Kowsik Guruswamy, chief technology officer at Menlo Security to Financial Times&period;&nbsp&semi;&NewLine;Although the Federal Bureau doesn&rsquo&semi;t recommend that a company pay hackers in these types of case, it still has happened before&period;&NewLine;&ldquo&semi;The most high-profile example was when Hollywood Presbyterian Medical Center paid a &dollar;17,000 ransom in bitcoin last year to hackers who seized control of the hospital&rsquo&semi;s computer systems,&rdquo&semi; writes Financial Times&period;&nbsp&semi;&NewLine;The personal information stolen included names, email addresses and phone numbers of both the Uber customers and the drivers&period; 600,000 U&period;S&period; drivers&rsquo&semi; license plate numbers were also taken in the breach&period;&nbsp&semi;&nbsp&semi; &NewLine;Unlike the recent massive Equifax cyber hack, no credit card information, along with customers&rsquo&semi; trip histories were included in the breach&period;&NewLine;When the company discovered the breach back in December of 2016, Uber decided to not notify regulators or the people comprised in the hack&period; On Tuesday, Uber finally acknowledged the breach&period; &nbsp&semi;&NewLine;Dara Khosrowshahi, who became Uber&rsquo&semi;s chief executive in September, said that once he heard about the breach, he ordered an investigation&period; &nbsp&semi;&NewLine;&ldquo&semi;At the time of the incident, we took immediate steps to secure the data and shut down further unauthorized access by the individuals,&rdquo&semi; said Khosrowshahi&period; &ldquo&semi;We subsequently identified the individuals and obtained assurances that the downloaded data had been destroyed&period; We also implemented security measures to restrict access to and strengthen controls on our cloud-based storage accounts&period;&rdquo&semi;&NewLine;However, these steps did not include alerting the individuals who were affected&period;&NewLine;Khosrowshahi has also asked for Sullivan, Uber&rsquo&semi;s chief security officer&rsquo&semi;s resignation, along with the lawyer that reported to him&period;&NewLine;&ldquo&semi;None of this should have happened, and I will not make excuses for it,&rdquo&semi; said Khosrowshahi&period;&NewLine;&ldquo&semi;While I can&rsquo&semi;t erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes&period; We are changing the way we do business&period;&rdquo&semi;&nbsp&semi;&NewLine;It&rsquo&semi;s safe to say that Khosrowshahi has a rocky road ahead of him&period;&nbsp&semi;&NewLine;&ldquo&semi;The latest news about the data breach is just one of many legacy bad decisions that Khosrowshahi has had to inherit since Kalanick was ousted from the company in June&period; The company is facing several other federal investigations into its business practices and is preparing to stand trial against accusations of trade secret misappropriation by its rival Waymo next month,&rdquo&semi; writes Forbes&period;&NewLine;&ldquo&semi;Mr&period; Khosrowshahi&rsquo&semi;s decision to publicly announce the data breach &mdash&semi; during a holiday week as the US celebrates Thanksgiving &mdash&semi; represents an effort to get skeletons out of the closet during the first months of his tenure,&rdquo&semi; writes Financial Times&period; &nbsp&semi;&NewLine;Apparently, trying to hide cyber breaches at companies is more common than you think&period;&NewLine;&ldquo&semi;Developers make mistakes on the cloud infrastructure, and hackers take advantage of that,&rdquo&semi; said Kobi Ben-Naim, the head of the cyber research lab at CyberArk to the Times of Israel&period;&NewLine;Author&rsquo&semi;s note&colon; This is another example of how irresponsible a technology company can be&period; Uber should have alerted those affected as soon as possible, instead of waiting a WHOLE year&period; Now the company&rsquo&semi;s PR nightmare is going to be even worse because Uber executives tried to hide it from their employees and customers&period;&NewLine;Editor&&num;8217&semi;s note&colon; Our privacy is under attack, no one seems to care the damage it does to the victims&period;&NewLine;&nbsp&semi;&NewLine;