Written by Katherine Rusk and Ruth E. Promislow
The CEO of the popular ride-sharing app, Uber, published a bombshell letter to the public yesterday, stating that two hackers had stolen information from almost 60 million driver and rider accounts in October 2016.
The compromised personal information includes names, email addresses, driver's license numbers, and mobile phone numbers. According to a statement from Dara Khosrowshahi, Uber's current CEO, the hackers did not gain access to credit card numbers, Social Security numbers, birth dates, or trip location information.
Anonymous sources speaking to Bloomberg and The New York Times said that the company's then Chief Executive Officer and Chief Security Officer brokered a deal with the hackers to pay $100,000 in ransom in exchange for the deletion of the data and a non-disclosure agreement, and that Uber hid the payouts. The New York Times reported that Uber has fired their CSO for this breach response.
Uber's revelation highlights two key issues for organizations in ensuring good cybersecurity hygiene.
The first issue is that third-party security is your security. The hackers' point of entry into Uber’s system was through a third-party cloud-based service. Using a third-party service to compromise a major corporation is frequent method of attack for hackers—as has been discovered lately by Orange Is The New Black, Target, Home Depot, Costco, and more.
Organizations using cloud-based service providers should understand the steps that the provider takes to maintain security. This is not only important for the purpose of preventing attacks, but it is also important for limiting exposure to claims arising as a result of the attack. Put more simply, your organization may be exposed for the failure by your third-party service provider to employ appropriate cybersecurity protocol.
The second issue highlighted by the Uber incident is that an organization may be exposed to liability not only for a breach itself, but for the way that it responds to the breach. The manner in which an organization handles a breach can give rise to claims—or can help reduce liability. The 2016 class action settlement for the Home Depot data breach shows how companies can mitigate their liability by taking proactive notification measures and by helping the impacted individuals alleviate any harm.
Regulators in the UK, Australia, the Philippines, and New York have already announced they will be looking into Uber's data breach.
Organizations must not only be proactive in seeking to prevent attacks but must also have a well-thought out plan already in place for responding to incidents.
Bennett Jones