Uber agrees to pay record $148 million to states over 2016 data breach

Uber has agreed to pay a record $148 million in state and local penalties to settle allegations that the company intentionally concealed a major data breach in 2016 that exposed the personal information of 57 million people, California Attorney General Xavier Becerra’s office said Wednesday.

The settlement comes in the wake of a multistate investigation that found the ride-hailing company paid hackers $100,000 to conceal the breach, which exposed the names, email addresses, and cellphone numbers of those users.

Uber did not provide public notice of the breach until a year after it happened in late 2016.

Board of directors unaware of ransom payment

The company’s board of directors were in the dark about the ransom payment until it was discovered by a law firm last spring. The firm was hired to investigate the company’s security team in a separate matter but stumbled on the breach during its inquiry. The board then hired a forensic firm to probe what happened with the breach.

Uber said in a November 2017 statement from CEO Dara Khosrowshahi that the breach was carried out by two hackers outside the company. The hackers accessed user data on a third-party, cloud-based service the company uses to store some information. They, however, were not able to download users’ Social Security numbers, bank account information, credit card numbers, dates of birth, and trip history, according to the company.

The hackers were able to collect the names, email addresses, and cellphone numbers of the 57 million people that use Uber and the driver’s license numbers of about 600,000 drivers, according to the company.

Uber eventually provided notice of the breach after an investigation, but that wasn’t until a year after the breach and ransom payment happened. 

Violated California law

California’s share of the settlement is $26 million, which it will split with the San Francisco district attorney’s office. DA George Gascon, who has frequently scrutinized Uber’s business practices, joined the investigation into the data breach.

Becerra said Uber violated California laws requiring companies to secure customers’ information and to promptly report data breaches affecting more than 500 people to the state Department of Justice. More than a quarter of the 600,000 Uber drivers who had their data exposed live in California.

The money will pay for more consumer enforcement actions, Becerra said.

“Anyone thinking about trying to evade the law, to skirt their responsibility to inform the public or law enforcement that a data breach has occurred … they better report it,” Becerra said. “Don’t think that you can hide it and get away with it. You will find yourself in the same position as Uber did.”

Working to improve safety & security

Uber Chief Legal Officer Tony West said in a statement on Wednesday that they are working to improve safety and security after the breach and have hired new experts to implement those improvements. He said the company learned from its mistake in 2016. “Our current management team’s decision to disclose the incident was not only the right thing to do, it embodies the principles by which we are running our business today: transparency, integrity, and accountability,” West said. “An important component of living up to those principles means taking responsibility for past mistakes, learning from them, and moving forward.”

Related: How to respond and recover quickly from a cyber event

The company’s notice in 2017 launched a nationwide investigation into its conduct in the wake of the breach. California is one of several states that independently investigated the breach before teaming up with other states on the probe.

The settlement is between Uber, all 50 states, and the District of Columbia.

New policy on data security being developed

Uber has also promised to develop a new policy on data security that will assess the potential risk of another breach and implement improvements beyond what’s currently in place. The company is required to hire an outside contractor to examine its security efforts regularly and recommend improvements.

Uber will also have to take additional precautions to protect any user data it stores on third-party platforms, such as the one hackers accessed in 2016. If there is another breach, employees must also have an avenue to report any ethics concerns they have about other employees. Those employees will also now be subject to stricter password guidelines to gain access to the company’s internal network.

Settlement does not resolve any consumer liability claims

The settlement does not resolve any liability that Uber may have to consumers, Becerra said. Uber is still litigating claims related to the breach in multidistrict litigation before U.S. District Judge Philip Gutierrez in the Central District of California.

Related: Uber discloses data breach affecting about 50,000 drivers

Dan M. Clark (dmclark@alm.com) is the Albany reporter for the New York Law Journal. He covers the state Court of Appeals, the state legislature, state regulators, and more. 

Cheryl Miller (cmiller@alm.com), based in Sacramento, covers the state legislature and emerging industries, including autonomous vehicles and marijuana. She authors the weekly cannabis newsletter Higher Law. On Twitter: @CapitalAccounts