Uber paid hackers $100K to hide a 2016 breach — 50 states fined it $148M for the cover-up

In October 2016, two hackers accessed a private GitHub repository used by Uber engineers and found credentials that let them into a cloud storage account holding rider and driver data. They downloaded names, email addresses and phone numbers for 57 million Uber users, plus roughly 600,000 US drivers' license numbers.

Rather than disclose the breach, Uber routed a $100,000 payment to the hackers through its bug-bounty program — the channel meant for security researchers who responsibly report flaws — on condition they destroy the data and sign non-disclosure agreements. The company did not notify affected users, drivers or any regulator. The breach only became public in November 2017, over a year later, after new CEO Dara Khosrowshahi took over and disclosed it himself.

Attorneys general in all 50 states and Washington, D.C. investigated the concealment as a violation of state data-breach notification laws, which generally require timely disclosure once a breach is discovered. In September 2018 Uber agreed to pay $148 million — a record multistate settlement at the time — and to adopt a corporate integrity program, improve its data security practices, and submit to independent third-party assessments of how it protects user data.