Uber Hit With Data Breach Class Action Lawsuit

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

Uber Technologies was hit with a class action lawsuit by a former driver over a data breach, in which he alleges his personal information was compromised, leading to identity theft.

Plaintiff Sasha Antman of Oregon worked as an Uber driver and alleges that the ride-sharing company “failed to notify drivers about a serious data breach it could have prevented.”

Uber was struck by a cyber attack in May 2014, the class action lawsuit explains, which resulted in hackers downloading files from Uber’s computer system, including its drivers’ personal information.

However, Antman alleges that Uber waited until Feb. 27 to disclose the cyber attack to the public, which it did in the form of a press release stating that “in late 2014, we identified a one-time access of Uber database by an unauthorized third party.”

In the press release, Uber said that it learned of the data breach by Sept. 17, 2014, but it took more than five months before informing the public of the event, the data breach class action lawsuit states. The ride-sharing company also said that it had filed its own “John Doe” lawsuit as part of the effort to identify who the hacker was.

“News reports and a subpoena issued by [Uber] in connection with the above-described Doe proceedings indicate that the ‘security key’ used by the Hacker to perpetrate the Data Breach was publicly available on the internet via one or more GitHub webpages,” the Uber class action lawsuit states. “In other words, [Uber] not only permitted all of the compromised Private Information to be accessible via a single password, but allowed that password to be publicly accessible via the internet.”

Antman alleges that for this reason and others, the Uber data breach cyber attack could have been prevented.

“It appears that [Uber] maintained the Private Information in unencrypted form, and that the Hacker was able to access it freely with a basic password,” the Oregon man alleges in the Uber data breach class action lawsuit.

Antman worked as a driver for Uber in San Francisco, which he says he hasn’t done since September 2013. He alleges that as a result of the personal identifiable information stolen from Uber during the cyber attack that he has been the victim of identity theft.

“On or around June 2, 2014, an unknown and unauthorized person used [Antman’s] private information to apply for a credit card with Capital One, which now appears on [his] credit report,” the Uber data breach class action lawsuit explains.

“[Antman] received notification from Defendant in or around March 2015, notifying him for the first time that his Private Information was disclosed in the Data Breach, even though he no longer was working as an Uber driver at the time of the Data Breach,” Antman explained.

In addition, Uber did not explain why it took so long for it to notify its drivers of the data breach, such as a police investigation.

Antman alleges in the data breach class action lawsuit that Uber’s “wrongful actions and inaction directly and proximately caused the theft and dissemination into the public domain of Plaintiff’s and Class members’ Private Information, causing them to suffer, and continue to suffer, economic damages and other actual harm for which they are entitled to compensation.”

The former Uber driver is proposing a nationwide class and a California class of Uber drivers “whose personal information was disclosed in the data breach affecting Uber.”

The Uber data breach class action lawsuit is charging the ride-sharing company with violating California civil laws, which demands that companies protect any personal information it may have in its possesstion and with violating California’s Unfair Competition Law.

The plaintiffs are represented by Robert Ahdoot, Tina Wolfson, Theodore W. Maya and Keith Custis of Ahdoot & Wolfson PC.

Counsel information for Uber is not yet available.

The Uber Data Breach Class Action Lawsuit is Sasha Antman v. Uber Technologies Inc., Case No. 3:15-cv-01175, in the U.S. District Court for the Northern District of California.

UPDATE: On Feb. 18, 2016, Lyft filed a motion with the court alleging Uber is using the discovery process in this class action to try and steal Lyft’s trade secrets.