Uber admits covering up 2016 data breach that impacted 57 million users

The US Department of Justice announced on friday that Uber Technologies Inc has admitted and accepted responsibility for concealing the 2016 data breach which impacted nearly 57 million users. 

The ride-hailing giant has entered a non-prosecution agreement with the federal prosecutors to avoid criminal prosecutors, and admitted that its team neglected to notify the U.S. Federal Trade Commission about the breach, despite the FTC’s pending data privacy investigation into the company at the time.  

United States Attorney Stephanie M. Hinds said it had been a year since the data leak when Uber first notified the FTC. While the former security chief Joseph Sullivan is still facing a criminal case for allegedly paying hackers $100.000 in bitcoin to remain silent about the breach, the successor CEO Dara Khosrowshahi, who took office in 2017, ordered a prompt investigation and the new executive team shared the details of the breach with the public and the authorities, the Department of Justice said.  

In September 2018, Uber agreed to pay $148 million to settle claims of data breach cover-up. In the same year, it reached an agreement with the Federal Trade Commission to implement a 20-year privacy program, under which it agreed to notify the FTC about the incidents shared with the other governmental agencies. 

Meanwhile, the ride-sharing company is also working closely with the authorities on the ongoing criminal case against Joseph Sullivan. The Department of Justice said the defendant is presumed innocent ‘until proven guilty beyond a reasonable doubt’, as the charges in the case are only allegations.