Uber in legal crosshairs over hack cover-up

Uber purportedly paid data thieves $100,000 to destroy the swiped information — and remained quiet about the breach for a year.

That decision evidently came despite a promise by the firm to “adopt leading data security protection practices” in a settlement with New York attorney general Eric Schneiderman.

Schneiderman and his counterpart in Connecticut, George Jepsen, on Wednesday told AFP that Uber is the target of probes in their states over the hidden hack.

“None of this should have happened, and I will not make excuses for it,” Uber chief executive Dara Khosrowshahi, who took over at the company in August, said Tuesday.

Two members of the Uber information security team who “led the response” that included not alerting users about the data breach were let go from the San Francisco-based company effective Tuesday, according to Khosrowshahi.

The Uber chief said he only recently learned that outsiders had broken into a cloud-based server used by the company for data and downloaded a “significant” amount of information.

Stolen files included names, email addresses, and mobile phone numbers for riders, and the names and driver license information of some 600,000 drivers, according to Uber.

Uber paid the hackers $100,000 to destroy the data, not telling riders or drivers whose information was at risk, according to a source familiar with the situation.

Co-founder and ousted chief Travis Kalanick was advised of the breach shortly after it was discovered, but it was not made public until Khosrowshahi learned of the incident, the source confirmed.

– Promise to protect –

In early 2016, Schneiderman announced a settlement with Uber stemming from an investigation into the company’s handling and protection of riders’ personal information.

The probe was prompted by word of a hack, and by reports that Uber executives were able to track the locations of riders in real-time using a tool known internally as “God View.”

The settlement required Uber to better protect rider data, and pay $20,000 for failing to tell drivers about the 2014 data breach in a timely manner.

Schneiderman’s office determined that the earlier hack took advantage of access information posted by an Uber engineer at software development platform Github.

Computer security specialists interviewed by AFP said the recent breach apparently involved a similar slip with a password that was taken from Github and used to get into Uber data stored in the cloud at Amazon Web Services.

“The fact that attackers were able to compromise an Amazon Web Services account and not come away with credit card numbers, social security numbers, and other highly sensitive information could mean that Uber had controls in place to keep this kind of data very well-secured,” said Covata vice president of security Mike Fleck.

“It’s also possible that the attackers just didn’t look very hard and Uber got lucky.”

Hackers are known to take seemingly low-value information, such as email addresses, and build on them with what they can find or steal elsewhere to prey on victims, according to McAfee vice president of labs Vincent Weafer.

“On the hacker side, there is aggregation, tying disparate data sets together,” Weafer said.

“There is no such thing as benign information; we really have to take better care.”

Law firm Keller Rohrback put out word on Wednesday that it is looking into the potential for a class action suit against Uber.

“By choosing not to disclose this massive data breach and attempting to mitigate the breach by paying the hackers to destroy the data, Uber has essentially rolled the dice with its customers’ and drivers’ personal identities,” law firm partner Cari Campen Laufenberg said in a release.

State law in Uber’s home state of California calls on companies to disclose big data breaches without unreasonable delay, meaning the handling of the hack could herald a rough stretch of road there.