Uber fined $1.1 million by UK and Dutch regulators over 2016 data breach

British and Dutch data protection regulators Tuesday hit the ride-sharing company Uber with a total fine of $1,170,892 (~ 1.1 million) for failing to protect its customers’ personal information during a 2016 cyber attack involving millions of users.

Late last year, Uber unveiled that the company had suffered a

massive data breach

in October 2016, exposing names, email addresses and phone numbers of 57 million Uber riders and drivers along with driving license numbers of around 600,000 drivers.

Besides this, it was also reported that instead of disclosing the breach at the time, the company

paid $100,000 in ransom

to the two hackers with access to the stolen data in exchange for keeping the incident secret and deleting the information.

Today Britain’s Information Commissioner’s Office (ICO)

fined

Uber 385,000 pounds ($491,102), while the Dutch Data Protection Authority (Dutch DPA)

levied

a 600,000 euro ($679,790) penalty on Uber for failing to protect the personal information of its 3 million British and 174,000 Dutch citizens, respectively.

"In 2016 a data breach occurred at the Uber concern in the form of unauthorized access to personal data of customers and drivers. The Uber concern is fined because it did not report the data breach to the Dutch DPA and the data subjects within 72 hours after the discovery of the breach," the Dutch DPA says.

The ICO also confirmed that the attackers were able to compromise Uber’s cloud-based storage system using stuffing attack—"a process by which compromised username and password pairs are injected into websites until they are matched to an existing account"—a loophole that could have been "avoided."

"Uber US did not follow the normal operation of its bug bounty programme. In this incident Uber US paid outside attackers who were fundamentally different from legitimate bug bounty recipients: instead of merely identifying a vulnerability and disclosing it responsibly, they maliciously exploited the vulnerability and intentionally acquired personal information relating to Uber users," the ICO states.

The UK watchdog also said that none of the affected customers compromised by the incident were notified of the breach. Instead, Uber started monitoring affected riders and drivers accounts for fraud 12 months after the cyber attack, when the incident was made public last year.

At the time, Uber notified regulatory authorities and offered affected drivers free credit monitoring and identity theft protection.

The company assured its users that other personal details, such as trip location history, credit card numbers, bank account numbers, Social Security numbers or dates of birth, were not accessed in the attack.

from The Hacker News https://ift.tt/2SewAgW