Uber will pay $148m and tighten data security after they failed for a year to notify drivers that hackers had stolen their personal information, according to a settlement announced on Wednesday.
The company reached the agreement with all 50 states and the District of Columbia after a vast data breach in 2016. Instead of reporting it, Uber hid evidence of the theft and paid ransom to ensure the data wouldn’t be misused.
“This is one of the most egregious cases we’ve ever seen in terms of notification; a yearlong delay is just inexcusable,” Lisa Madigan, the Illinois attorney general, told the Associated Press. “And we’re not going to put up with companies, Uber or any other company, completely ignoring our laws that require notification of data breaches.”
Uber learned in November 2016 that hackers had accessed personal data, including driver’s license information, for roughly 600,000 drivers in the US. The on-demand ride company acknowledged the breach in November 2017, saying it had paid $100,000 in ransom for the stolen information to be destroyed.
The hack also took the names, email addresses and cellphone numbers of 57 million riders around the world. After significant management changes in the past year, Tony West, Uber’s chief legal officer, said the decision by current managers was “the right thing to do”.