Pennsylvania AG suing Uber over 2016 data breach
PHILADELPHIA -- Pennsylvania's attorney general is suing the ride-hailing company Uber, saying it broke state law when it failed to notify thousands of drivers for a year that hackers stole their personal information. The lawsuit filed Monday in Philadelphia said hackers stole the names and drivers' license numbers of at least 13,500 Pennsylvania Uber drivers.
It accuses Uber of violating a state law to notify people of a data breach affecting them within a "reasonable time frame."
Uber acknowledged in November that for more than a year it covered up a hacking attack that stole personal information about more than 57 million customers and drivers. Pennsylvania's lawsuit seeks civil penalties in the millions of dollars.
"Uber violated Pennsylvania law by failing to put our residents on timely notice of this massive data breach," Attorney General Josh Shapiro said, according to CBS affiliate KDKA-TV. "Instead of notifying impacted consumers of the breach within a reasonable amount of time, Uber hid the incident for over a year – and actually paid the hackers to delete the data and stay quiet. That's just outrageous corporate misconduct, and I'm suing to hold them accountable and recover for Pennsylvanians."
In a statement, Uber's chief legal officer Tony West said he reached out to Shapiro several weeks ago to discuss the data breach and was "surprised" by the complaint.
"I look forward to continuing the dialogue we've started as Uber seeks to resolve this matter. We make no excuses for the previous failure to disclose the data breach," West said. "While we do not in any way minimize what occurred, it's crucial to note that the information compromised did not include any sensitive consumer information such as credit card numbers or social security numbers."
This isn't the first time the company has faced legal issues. Last month, it settled with Google's Waymo for about $245 million over allegations of stolen trade secrets.
As CNET reports, data breaches have become a fact of life for many consumers. Last month, U.S. Attorney General Jeff Sessions announced the formation of a cybersecurity task force to look into a range of threats.
The Pennsylvania attorney general's office is also taking multiple breaches into account. For example, personal information stolen from the Equifax breach could be combined with data from the Uber breach, giving criminals a greater opportunity to commit identity theft.
The Pennsylvania AG's office is asking any state residents who feel they were affected by Uber's breach to file a complaint with the Bureau of Consumer Protection at scams@attorneygeneral.gov.