Request Demo

NIST Cybersecurity Framework

What to Learn From Uber's 2016 Data Breach... That The Company Just Disclosed This Month


Just last week, Uber disclosed that hackers accessed the personal information of 57 million riders and drivers in October 2016, a breach it didn’t disclose publicly until November 21, 2017. This lack of Due Care and ethical process is making waves in the media as this incident adds a potential legal burden for the company.

What Happened?

According to the CEO of Uber, Dara Khosrowshahi, two hackers broke into the company in late 2016. Although there is no indication that trip location history, credit card numbers, bank account numbers, Social Security numbers or dates of birth were downloaded, the hackers were able to download files containing a significant amount of other information, including:

  • The names and driver’s license numbers of around 600,000 drivers in the United States.

  • Personal information including phone numbers, email addresses, and names of 57 million Uber users (drivers described above are included) around the world.

Khosrowshahi says hackers accessed the data through a third-party, cloud-based service. They found private authentication information that Uber engineers had accidentally exposed publicly on GitHub, a site many engineers and companies use to store code and track projects. The attack began when hackers got their hands on Uber user data stored on an Amazon server.

The $100,000 Payment to The Hackers

Law enforcement advises companies to not pay hackers and report breaches to the authorities whenever there is an attack. However, instead of alerting users and authorities, Uber paid the hackers $100,000.. perhaps to keep quiet and resolve the incident as quickly as possible.

The company’s failure to disclose the breach was very amateur. An Uber driver who has not yet to receive any communication from the company stated, “I found out through the media. Uber doesn’t get out in front of things, they hide them.” Just a small reminder that a data breach not only effects your business success in dollars, but also in reputation.

This incident didn't just upset riders and drivers. It will ultimately affect the company legally. There is no doubt that Uber will face possible consequences from both state and federal agencies, and it is going to be heavily fined for this incident. “Forty-eight states have security breach notification laws which require companies to disclose when hacker access private information,” including California, where Uber’s headquarters is located. Furthermore, the Uber breach affects non-U.S. users too, so it there could be some international consequences.

Uber’s Solution

According to Khosrowshahi, Uber is individually notifying the drivers whose driver’s license numbers were downloaded and providing these drivers with free credit monitoring and identity theft protection.

Here are some tips if you've been on Uber and want to reinstate your resilience in case your data was stolen, which you may never know.

As businesses leaders, what lesson can we learn from this incident?

Cybercriminals are always looking for vulnerabilities, and Uber clearly had some. The attackers used hardly a sophisticated process compared to other major cyberattacks that happened this year. Ultimately, it was the cause of a lack of Due Care and negligence.

At the same time, you could sympathize with companies who are carrying around such data that they're more attractive for cyber criminals. These questions arise..

How could they have had the visibility to look into their program and see every vulnerability? How could they have known that everyone in their organization was doing their job correctly? That human error was as reduced as possible? That they were following best practices? How could they have even known that what they were doing was best practice at all? As compared to what?

CyberStrong was created to solve each one of these questions.

CyberStrong provides visibility, reporting, measurement and mapping to the gold-standard NIST Cybersecurity Framework. Imaging having the ability to map your company's individual strategy to this massive set of best practices in just hours.. you can enhance the security and resilience of your organization as you receive recommendations for improvement based on cost-impact on your resilience, and make informed decisions based on your existing gaps. A risk-based approach, measure your risk and cyber posture continuously, day to day, and see your team in action to eliminate human error. Take advantage of an effective and specific solutions while retaining flexibility within your own program.

When it comes to cybersecurity, we all need to be proactive in our organizations for the sake of both our companies and our customers. At least for the sake of negative social implications, we don’t want another “Uber incident” to occur caused by vulnerabilities that could have been prevented.

Webinar: The Benefits of Cybersecurity Frameworks and Standards

Cybersecurity Influencers Give a Masterclass On the Use of Frameworks & Standards

Featuring the European Young Innovator of the Year 2017 Emerald de Leeuw

January 4th 2018 @ 12:00pm EST | 4:00pm BST



You may also like

Integrating GRC: Governance, ...
on June 6, 2019

In our Integrating Governance Risk and Compliance series, CyberSaint leadership explores the process through which cybersecurity leaders can reconfigure their organizations to ...

Jerry Layden
Critical Capabilities of Cyber ...
on June 4, 2019

As Boards and CEOs start taking a greater concern with the security posture of their enterprise, CISOs and information security teams are being faced with translating their cyber ...

Integrating Governance, Risk, and ...
on May 30, 2019

When Gartner released the magic quadrant for integrated risk management (IRM) in 2018 rather than for governance risk and compliance (GRC), members of the information security ...

An Integrated Risk Management ...
on May 28, 2019

As cybersecurity is elevated to a Board- and CEO-level issue, the role it plays in overall enterprise risk management is is becoming more apparent. With that comes a need for an ...

Using NIST 800-30 To Implement The ...
on May 23, 2019

The National Institutes of Standard and Technology’s Risk Management Framework (RMF) is a foundational aspect to managing cybersecurity risk. When coupled with the NIST ...

NIST Cybersecurity Framework Tool ...
on May 21, 2019

For almost all organizations large and small the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) represents the gold standard for managing ...