Uber Class Action Says Company Tried to Hide Massive Data Breach

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

The beleaguered ride-share company Uber faces a class action lawsuit alleging a massive data breach was hidden from the public for more than a year.

Lead plaintiffs allege that Uber waited over a year to disclose that a massive data breach exposed the personally identifiable information of 57 million customers worldwide in October 2016.

Hackers, allege the plaintiffs, were able to obtain access to a third-party cloud service and steal archived passenger and driver data from Uber.

Further, alleges the Uber class action lawsuit, Uber tried to cover up the breach by paying the hackers $100,000 to delete the information and keep quiet.

According to a statement released by Uber’s CEO, he only recently became aware of the breach and the actions taken to keep the information from the public and regulators.

“At the time of the incident, we took immediate steps to secure the data and shut down further unauthorized access by the individuals. We subsequently identified the individuals and obtained assurances that the downloaded data had been destroyed. We also implemented security measures to restrict access to and strengthen controls on our cloud-based storage accounts,” Uber’s CEO states. 

Uber’s CEO goes on to say that he initiated an immediate investigation into why the breach was not disclosed to regulators and those whose personally identifiable information was accessed. He says that he has initiated “several actions” in response, but the class action lawsuit claims that these actions are not enough.

“As a result of Uber’s negligence and wanton and reckless disregard of data breach notification requirements, millions of Americans are now — and have been for over one year — at risk of identity theft,” alleges the Uber class action lawsuit.

Hackers obtained access to Uber driver and passenger private information through a third-party cloud service. One the hackers had the data, alleges the Uber class action lawsuit, they ransomed it to Uber. Uber should have notified the authorities and those affected by the breach, say the plaintiffs, but instead they paid the hackers to keep the massive breach quiet.

“Uber has had a reputation for flouting regulations since its founding in 2009. At the time of the Data Breach, Uber was negotiating with various U.S. regulators investigating separate claims of privacy violations,” alleges the Uber complaint.

According to the class action lawsuit, the Uber data breach has increased the risk of identity theft because the information exposed includes names, Social Security numbers, and other information that people will not be able to change easily.

“Unlike the credit and debit card numbers stolen in some of the other recent high-profile data breaches, much of the information furnished here cannot simply be changed, and will continue to be valuable to identity thieves for many years,” say the plaintiffs.

The plaintiffs seek to represent a nationwide Class of people whose data was compromised as a result of the Uber data breach, along with a South Carolina subclass.

The Uber class action seeks an injunction against Uber for its allegedly fraudulent misrepresentation of the 2016 data breach. The plaintiffs are also seeking damages, including restitution for putative Class Members and punitive damages against Uber.

The plaintiffs are represented by Matthew J. Preusch, Christopher L. Springer, Lynn Lincoln Sarko, Gretchen Freeman Cappio, and Cari Campen Laufenberg of Keller Rohrback LLP, and Jodi Flowers, Breanne Cope, Laura Ray, and Mathew Jasinski of Motley Rice LLC.

The Uber Data Breach Class Action Lawsuit is Danyelle Townsend, et al. v. Uber Technologies Inc., Case No. 4:17-cv-06756-DMR, in the U.S. District Court for the Northern District of California, San Francisco Division.