Uber Faces More Litigation over Passengers’ Personal Data Theft

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

A class action lawsuit accusing Uber of failing to properly protect passengers’ information from hackers has been removed to federal court.

Defendant Uber Technologies Inc. filed papers for removal on Thursday, taking the Uber class action lawsuit out of the California state court where it was originally filed in November.

Plaintiffs Jaideep Chadha and Madeline Johnson claim Uber exposed passengers to the risk of fraud and identity theft by failing to protect their personally identifiable information from a data breach that occurred in the fall of 2016.

According to this Uber class action lawsuit, Uber received contact in November 2016 from an individual who claimed to have gotten unauthorized access to Uber customer information. Uber investigated and confirmed the claim, finding that the unauthorized access went on for about a month between October and November 2016.

About 50 million Uber passengers’ information was exposed during this breach, the plaintiffs say. Information exposed included their names, email addresses and telephone numbers. In addition to the passengers’ information, names and drivers license numbers of about 7 million Uber drivers were also exposed.

Uber responded by paying the purported hackers to delete the information and keep quiet about the breach. The company then kept the incident under wraps for a full year before it finally began notifying affected passengers in November 2017, according to Chadha and Johnson.

Uber’s CEO claims he was unaware of the breach until long after it happened. He claims the company got assurances from the hackers that the stolen data had been destroyed, then took steps to make its cloud-based storage accounts more secure.

The plaintiffs blame the breach on Uber’s failure to implement appropriate safeguards that would have protected its passengers’ information. Passengers were further harmed by Uber’s delay in notifying them about the breach, leaving affected persons’ information exposed without their knowledge for more than 12 months.

Besides Chadha and Johnson, other plaintiffs are already taking Uber to task with data breach class action lawsuits of their own. Within days of Uber’s announcement of the breach, a group of plaintiffs filed their action in California federal court, claiming Uber’s response to the breach was grossly inadequate.

Chadha and Johnson’s Uber class action lawsuit includes claims for violation of the California Unfair Competition Law, state data breach statutes, the California Constitution’s invasion of privacy provision, and the consumer protection laws of several other states.

They propose to represent a Class consisting of all U.S. residents whose personally identifiable information was compromised in the Uber data breach. They also propose a subclass covering Class Members who reside in California.

The plaintiffs are seeking a court order barring Uber from mishandling passengers’ sensitive information in the future and requiring Uber to issue prompt and complete disclosures in the event such information is compromised. They seek an award of damages, restitution and disgorgement, court costs and attorneys’ fees.

Chadha and Johnson are represented by attorneys Christopher Aumais, Thomas Girardi and Ashkahn Mohamadi of Girardi Keese.

The Uber Data Breach Class Action Lawsuit is Chadha, et al. v. Uber Technologies Inc., Case No. 2:18-cv-00263-DMG-AFM, in the U.S. District Court for the Central District of California.