• About
  • Offices
  • Careers
  • News
  • Students
  • Alumni
  • Payments
  • FR
Background Image
Bennett Jones Logo
  • People
  • Expertise
  • Knowledge
  • Search
  • FR Menu
  • Search Mobile
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
View all
Practices
Corporate Litigation Regulatory Tax View all
Industries
Capital Projects Energy Funds & Finance Mining View all
Advisory
Crisis & Risk Management ESG Strategy and Solutions Governmental Affairs & Public Policy
View Client Work
International Experience
Insights News Events
New Energy Economy Series Business Law Talks Podcast Economic Outlook
ESG & the CIO Subscribe
People
Practices
Industries
Advisory Services
Client Work
About
Offices
News
Careers
Insights
Law Students
Events
Search
Alumni
Payments
Subscribe

Stay informed on the latest business and legal insights and events.

LinkedIn LinkedIn Twitter Twitter Vimeo Vimeo
 
Blog

Grand Theft Data: Uber Announces Almost 60 Million Accounts Compromised in Data Breach

November 22, 2017

Written By Katherine Rusk and Ruth E. Promislow

The CEO of the popular ride-sharing app, Uber, published a bombshell letter to the public yesterday, stating that two hackers had stolen information from almost 60 million driver and rider accounts in October 2016.

The compromised personal information includes names, email addresses, driver's license numbers, and mobile phone numbers. According to a statement from Dara Khosrowshahi, Uber's current CEO, the hackers did not gain access to credit card numbers, Social Security numbers, birth dates, or trip location information.

Anonymous sources speaking to Bloomberg and The New York Times said that the company's then Chief Executive Officer and Chief Security Officer brokered a deal with the hackers to pay $100,000 in ransom in exchange for the deletion of the data and a non-disclosure agreement, and that Uber hid the payouts. The New York Times reported that Uber has fired their CSO for this breach response.

Uber's revelation highlights two key issues for organizations in ensuring good cybersecurity hygiene.

The first issue is that third-party security is your security. The hackers' point of entry into Uber’s system was through a third-party cloud-based service. Using a third-party service to compromise a major corporation is frequent method of attack for hackers—as has been discovered lately by Orange Is The New Black, Target, Home Depot, Costco, and more.

Organizations using cloud-based service providers should understand the steps that the provider takes to maintain security. This is not only important for the purpose of preventing attacks, but it is also important for limiting exposure to claims arising as a result of the attack. Put more simply, your organization may be exposed for the failure by your third-party service provider to employ appropriate cybersecurity protocol.

The second issue highlighted by the Uber incident is that an organization may be exposed to liability not only for a breach itself, but for the way that it responds to the breach. The manner in which an organization handles a breach can give rise to claims—or can help reduce liability. The 2016 class action settlement for the Home Depot data breach shows how companies can mitigate their liability by taking proactive notification measures and by helping the impacted individuals alleviate any harm.

Regulators in the UK, Australia, the Philippines, and New York have already announced they will be looking into Uber's data breach.

Organizations must not only be proactive in seeking to prevent attacks but must also have a well-thought out plan already in place for responding to incidents.

Download PDF

Author

  • Ruth E. Promislow Ruth E. Promislow, Partner

Fall 2022 Economic Outlook: Managing Risks and Taking Action

Related Links

  • Insights
  • Media
  • Subscribe

Recent Posts

Blog

Alberta Court Confirms Exclusive Jurisdiction of Labour [...]

February 03, 2023
       

Blog

Competition Bureau Seeks Feedback on Enforcement Guidance [...]

February 03, 2023
       

Blog

New CSA Exemption Relating to Proxy Requirements For [...]

February 03, 2023
       

Blog

What's Done is Done: Alberta Court of Appeal Declines [...]

February 01, 2023
       

Blog

Electric Contracts for Electric Vehicles: The Key Considerations

February 01, 2023
       
Bennett Jones Centennial Footer
Bennett Jones Centennial Footer
About
  • Leadership
  • Diversity
  • Community
  • Innovation
  • Security
  • History
Offices
  • Calgary
  • Edmonton
  • Montréal
  • Ottawa
  • Toronto
  • Vancouver
  • New York
Connect
  • Insights
  • News
  • Events
  • Careers
  • Students
  • Alumni
Subscribe

Stay informed on the latest business and legal insights and events.

LinkedIn LinkedIn Twitter Twitter Vimeo Vimeo
© Bennett Jones LLP 2023. All rights reserved.
  • Privacy Policy
  • Disclaimer
  • Terms of Use
Logo Bennett Jones