Free Cyber Risk Analysis: Your Top Cyber Risks in 3 Clicks

Get Started
Request Demo

NIST Cybersecurity Framework

What to Learn From Uber's 2016 Data Breach... That The Company Just Disclosed This Month


Just last week, Uber disclosed that hackers accessed the personal information of 57 million riders and drivers in October 2016, a breach it didn’t disclose publicly until November 21, 2017. This lack of Due Care and ethical process is making waves in the media as this incident adds a potential legal burden for the company.

What Happened?

According to the CEO of Uber, Dara Khosrowshahi, two hackers broke into the company in late 2016. Although there is no indication that trip location history, credit card numbers, bank account numbers, Social Security numbers or dates of birth were downloaded, the hackers were able to download files containing a significant amount of other information, including:

  • The names and driver’s license numbers of around 600,000 drivers in the United States.

  • Personal information including phone numbers, email addresses, and names of 57 million Uber users (drivers described above are included) around the world.

Khosrowshahi says hackers accessed the data through a third-party, cloud-based service. They found private authentication information that Uber engineers had accidentally exposed publicly on GitHub, a site many engineers and companies use to store code and track projects. The attack began when hackers got their hands on Uber user data stored on an Amazon server.

The $100,000 Payment to The Hackers

Law enforcement advises companies to not pay hackers and report breaches to the authorities whenever there is an attack. However, instead of alerting users and authorities, Uber paid the hackers $100,000.. perhaps to keep quiet and resolve the incident as quickly as possible.

The company’s failure to disclose the breach was very amateur. An Uber driver who has not yet to receive any communication from the company stated, “I found out through the media. Uber doesn’t get out in front of things, they hide them.” Just a small reminder that a data breach not only affects your business's success in dollars but also in reputation.

This incident didn't just upset riders and drivers. It will ultimately affect the company legally. There is no doubt that Uber will face possible consequences from both state and federal agencies, and it is going to be heavily fined for this incident. “Forty-eight states have security breach notification laws which require companies to disclose when hackers access private information,” including California, where Uber’s headquarters is located. Furthermore, the Uber breach affects non-U.S. users too, so it there could be some international consequences.

Uber’s Solution

According to Khosrowshahi, Uber is individually notifying the drivers whose driver’s license numbers were downloaded and providing these drivers with free credit monitoring and identity theft protection.

Here are some tips if you've been on Uber and want to reinstate your resilience in case your data was stolen, which you may never know.

As businesses leaders, what lesson can we learn from this incident?

Cybercriminals are always looking for vulnerabilities, and Uber clearly has some. The attackers used hardly a sophisticated process compared to other major cyberattacks that happened this year. Ultimately, it was the cause of a lack of Due Care and negligence.

At the same time, you could sympathize with companies who are carrying around such data that they're more attractive for cybercriminals. These questions arise..

How could they have had the visibility to look into their program and see every vulnerability? How could they have known that everyone in their organization was doing their job correctly? That human error was as reduced as possible? That they were following best practices? How could they have even known that what they were doing was best practice at all? As compared to what?

CyberStrong was created to solve each one of these questions.

CyberStrong provides visibility, reporting, measurement, and mapping to the gold-standard NIST Cybersecurity Framework. Imagine having the ability to map your company's individual strategy to this massive set of best practices in just hours.. you can enhance the security and resilience of your organization as you receive recommendations for improvement based on cost-impact on your resilience, and make informed decisions based on your existing gaps. A risk-based approach, measures your risk and cyber posture continuously, day to day, and see your team in action to eliminate human error. Take advantage of effective and specific solutions while retaining flexibility within your own program.

When it comes to cybersecurity, we all need to be proactive in our organizations for the sake of both our companies and our customers. At least for the sake of negative social implications, we don’t want another “Uber incident” to occur caused by vulnerabilities that could have been prevented.

Webinar: The Benefits of Cybersecurity Frameworks and Standards

Cybersecurity Influencers Give a Masterclass On the Use of Frameworks & Standards

Featuring the European Young Innovator of the Year 2017 Emerald de Leeuw

January 4th 2018 @ 12:00pm EST | 4:00pm BST



You may also like

Critical Capabilities of Cyber ...
on May 20, 2024

In today's digital landscape, robust cybersecurity risk assessment tools are crucial for effectively identifying and mitigating cyber threats. These tools serve as the first line ...

A Practical Approach to FAIR Cyber ...
on May 10, 2024

In the ever-evolving world of cybersecurity, managing risk is no longer about simply setting up firewalls and antivirus software. As cyber threats become more sophisticated, ...

Unveiling the Best Cyber Security ...
on April 24, 2024

Considering the rollout of regulations like the SEC Cybersecurity Rule and updates to the NIST Cybersecurity Framework; governance and Board communication are rightfully ...

April Product Update
on April 18, 2024

The CyberSaint team is dedicated to providing new features to CyberStrong and advancing the CyberStrong cyber risk management platform to address all your cybersecurity needs. ...

Bridging the Gap: Mastering ...
on April 22, 2024

In today's digital landscape, cybersecurity has become essential to corporate governance. With the increasing frequency and sophistication of cyber threats, the SEC has set forth ...

March Product Update
on March 21, 2024

The CyberSaint team is dedicated to advancing the CyberStrong platform to meet your cyber risk management needs. These latest updates will empower you to benchmark your ...