Request Demo

NIST Cybersecurity Framework

What to Learn From Uber's 2016 Data Breach... That The Company Just Disclosed This Month


Just last week, Uber disclosed that hackers accessed the personal information of 57 million riders and drivers in October 2016, a breach it didn’t disclose publicly until November 21, 2017. This lack of Due Care and ethical process is making waves in the media as this incident adds a potential legal burden for the company.

What Happened?

According to the CEO of Uber, Dara Khosrowshahi, two hackers broke into the company in late 2016. Although there is no indication that trip location history, credit card numbers, bank account numbers, Social Security numbers or dates of birth were downloaded, the hackers were able to download files containing a significant amount of other information, including:

  • The names and driver’s license numbers of around 600,000 drivers in the United States.

  • Personal information including phone numbers, email addresses, and names of 57 million Uber users (drivers described above are included) around the world.

Khosrowshahi says hackers accessed the data through a third-party, cloud-based service. They found private authentication information that Uber engineers had accidentally exposed publicly on GitHub, a site many engineers and companies use to store code and track projects. The attack began when hackers got their hands on Uber user data stored on an Amazon server.

The $100,000 Payment to The Hackers

Law enforcement advises companies to not pay hackers and report breaches to the authorities whenever there is an attack. However, instead of alerting users and authorities, Uber paid the hackers $100,000.. perhaps to keep quiet and resolve the incident as quickly as possible.

The company’s failure to disclose the breach was very amateur. An Uber driver who has not yet to receive any communication from the company stated, “I found out through the media. Uber doesn’t get out in front of things, they hide them.” Just a small reminder that a data breach not only effects your business success in dollars, but also in reputation.

This incident didn't just upset riders and drivers. It will ultimately affect the company legally. There is no doubt that Uber will face possible consequences from both state and federal agencies, and it is going to be heavily fined for this incident. “Forty-eight states have security breach notification laws which require companies to disclose when hacker access private information,” including California, where Uber’s headquarters is located. Furthermore, the Uber breach affects non-U.S. users too, so it there could be some international consequences.

Uber’s Solution

According to Khosrowshahi, Uber is individually notifying the drivers whose driver’s license numbers were downloaded and providing these drivers with free credit monitoring and identity theft protection.

Here are some tips if you've been on Uber and want to reinstate your resilience in case your data was stolen, which you may never know.

As businesses leaders, what lesson can we learn from this incident?

Cybercriminals are always looking for vulnerabilities, and Uber clearly had some. The attackers used hardly a sophisticated process compared to other major cyberattacks that happened this year. Ultimately, it was the cause of a lack of Due Care and negligence.

At the same time, you could sympathize with companies who are carrying around such data that they're more attractive for cyber criminals. These questions arise..

How could they have had the visibility to look into their program and see every vulnerability? How could they have known that everyone in their organization was doing their job correctly? That human error was as reduced as possible? That they were following best practices? How could they have even known that what they were doing was best practice at all? As compared to what?

CyberStrong was created to solve each one of these questions.

CyberStrong provides visibility, reporting, measurement and mapping to the gold-standard NIST Cybersecurity Framework. Imaging having the ability to map your company's individual strategy to this massive set of best practices in just hours.. you can enhance the security and resilience of your organization as you receive recommendations for improvement based on cost-impact on your resilience, and make informed decisions based on your existing gaps. A risk-based approach, measure your risk and cyber posture continuously, day to day, and see your team in action to eliminate human error. Take advantage of an effective and specific solutions while retaining flexibility within your own program.

When it comes to cybersecurity, we all need to be proactive in our organizations for the sake of both our companies and our customers. At least for the sake of negative social implications, we don’t want another “Uber incident” to occur caused by vulnerabilities that could have been prevented.

Webinar: The Benefits of Cybersecurity Frameworks and Standards

Cybersecurity Influencers Give a Masterclass On the Use of Frameworks & Standards

Featuring the European Young Innovator of the Year 2017 Emerald de Leeuw

January 4th 2018 @ 12:00pm EST | 4:00pm BST



You may also like

The Cybersecurity Skills Gap: The ...
on February 7, 2019

The cybersecurity skills gap is nothing new to the seasoned cyber professional. It has been widely discussed in cyber and information security circles for some time. The main flag ...

George Wrenn
The Post-Digitization CISO
on February 5, 2019

Information leaders in digital businesses, whether focusing on optimization or a full transformation, are inherently altering their position among the executive leadership. As ...

Integrated Risk Management and ...
on January 31, 2019

With technology permeating every aspect of a business, one begins to wonder what technology is reserved for digital risk management rather than the other facets of integrated risk ...

Department of Defense Launches ...
on January 29, 2019

The Defense Federal Acquisition Regulation Supplement (DFARS) mandate, specifically Clause 252.204-7012 requiring all members of the Department of Defense’s supply chain to comply ...

Digital Risk Management Frameworks
on January 24, 2019

As organizations continue to embrace digitization, security teams are faced with the challenge of keeping the enterprise secure while empowering growth and innovation. Many CISO’s ...

The Cybersecurity Impact Of The ...
on January 23, 2019

There has been a great deal of speculation around the cybersecurity posture of the nation in light of the most recent (and longest documented) government shutdown. I’ve seen two ...

George Wrenn