Uber reaches settlement with feds over 2016 data breach

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

Uber data breach settlement overview: 

• Who: Uber has reached a non-prosecution agreement with the U.S. Department of Justice to end a criminal investigation into its handling of a 2016 data breach. 
• Why: Uber has acknowledged it concealed the data breach from the Federal Trade Commission for approximately a year. 
• Where: The Uber data breach affected riders and drivers nationwide. 

Uber has reached a non-prosecution agreement with the U.S. Department of Justice (DOJ) that will put an end to a criminal investigation into the company’s cover-up of a 2016 data breach that exposed the information of 57 million riders. 

The ride-hailing company admits, as part of the agreement, that it concealed the breach from the Federal Trade Commission (FTC) for around a year, despite an investigation into the incident, Law360 reports. 

The DOJ says Uber did not report the data breach to the FTC until approximately a year after it occurred and only after a new executive leadership team began managing the company. 

“Upon learning of the 2016 data breach, the new leadership team investigated the breach and disclosed it to affected drivers, to the public, to law enforcement and to foreign and domestic regulators, including state attorneys general and the FTC,” the DOJ said in a statement. 

Hackers reportedly used stolen credentials to obtain a private access key after gaining entry to a private source code repository, allowing them to collect data connected to Uber users and drivers, including roughly 600,000 drivers license numbers, Law360 reports. 

Uber settlement acknowledges DOJ company’s efforts to improve security going forward

The agreement, meanwhile, acknowledged that there has been a change in Uber’s executive management since the incident and recognized that the new leadership promptly investigated the data breach and has since gone to lengths to improve its security. 

“The company has invested substantial resources to significantly restructure and enhance the company’s compliance, legal and security functions,” the DOJ said in its statement. 

Uber first acknowledged the data breach in November 2017, releasing a statement at the time that said it never “should have happened” and the company would “learn from our mistakes.” 

The company later agreed in September 2018 to pay $148 million as part of a joint settlement reached with law enforcement officers from all 50 U.S. states, Law360 reports. 

Employees of Uber and Lyft filed a class action lawsuit earlier this year over claims the two companies have created a duopoly to suppress competition for driver pay and working conditions. 

Were you affected by the 2016 Uber data breach? Let us know in the comments! 

Read About More Class Action Lawsuits & Class Action Settlements:

• Data breach average cost tops $9.5M, according to report
• Health care data breach exposes data of 650+ medical providers
• LendingTree class action alleges data breach exposed data of 200K customers
• Timios data breach class action settlement