Careem's rapid growth left 14 million users' data exposed to hackers

Careem was the Middle East's answer to Uber — a Dubai-based ride-hailing app that had grown rapidly across more than a dozen countries, from the Gulf to North Africa, Pakistan and Turkey. Like other platforms, it held the personal data of millions of customers and the drivers who served them.

On 14 January 2018 Careem detected that its systems had been breached. Hackers had accessed the account data of about 14 million people — riders and drivers alike — taking names, email addresses, phone numbers and trip records. It was one of the largest data breaches reported in the region.

Careem did not announce the breach immediately. It disclosed it publicly on 23 April 2018, roughly three months after detection, saying it had needed time to investigate and had worked with law enforcement and security specialists. The gap drew the usual question about how quickly a company should tell its users.

The case is a reminder that fast-growing platforms are data targets before they are anything else. Careem had raced to add cities and users, and the personal information that came with that growth became an asset for attackers. The lesson is that security has to scale as fast as the user base, and that disclosure timing is itself part of the response.