Uber’s European operation has been fined £385,000 for a data breach that affected almost 3 million British users, the Information Commissioner’s Office has announced.
In November 2016, attackers obtained credentials to access Uber’s cloud servers and downloaded 16 large files, including the records of 35 million users worldwide. The records included passengers’ full names, phone numbers, email addresses, and the location where they had signed up.
Drivers were also affected, with 3.7 million, including 82,000 from the UK, having their weekly pay, trip summaries and, in a small number of cases, driver’s licence numbers accessed.
The ICO said the breach was caused by inadequate information security, and was compounded by Uber US’s decision to not disclose the attack, instead complying with the hackers’ demands to pay $100,000 as a “bug bounty”. Such bounties are common in the security world, with companies offering rewards to researchers who find and notify them of system weaknesses before they can be attacked.
However, the ICO wrote: “Uber US did not follow the normal operation of its bug bounty programme. In this incident Uber US paid outside attackers who were fundamentally different from legitimate bug bounty recipients: instead of merely identifying a vulnerability and disclosing it responsibly, they maliciously exploited the vulnerability and intentionally acquired personal information relating to Uber users.”
It said none of the people whose personal data had been compromised were notified of the breach. Instead, the company only began monitoring accounts for fraud 12 months after the attack.
However, the potential penalty was mitigated by the fact that Uber’s European branches were also not informed of the breach, meaning the company was not able to report it to the commissioner; and by the lack of evidence that the compromised data was misused.
Uber US was ordered in September to pay $148m for failing to notify drivers about the breach.
In a statement, Uber said “We’re pleased to close this chapter on the data incident from 2016. As we shared with European authorities during their investigations, we’ve made a number of technical improvements to the security of our systems both in the immediate wake of the incident as well as in the years since.
“We’ve also made significant changes in leadership to ensure proper transparency with regulators and customers moving forward. Earlier this year we hired our first chief privacy officer, data protection officer, and a new chief trust and security officer. We learn from our mistakes and continue our commitment to earn the trust of our users every day.”
The timing of the breach meant the fine was issued under the old Data Protection Act 1998, which sets out a maximum financial penalty of £500,000. Under the DPA 2018, which brings the EU’s general data protection regulation into British law, the potential fine would be much higher, at up to 4% of Uber’s global revenue.