Uber Breach Kept Under Wraps For A Year Affects 57 Million Riders And Drivers

Uber is in the news again and this time it’s really bad press. The company disclosed that information on 57 million drivers and riders was stolen in 2016 and they kept that harmful tidbit from getting out for over a year. The data accessed was from a third-party server by a couple of hackers who then approached Uber with an extortion offer to delete the data they stole. And Uber executives did just that. But wait!  There’s even more to this saga.

First, Uber claims that the information stolen was names, phone numbers, and email addresses…and that’s all. Uber does not feel the need to contact those affected. The company says it’s because they have not detected any misuse of the information. However, better safe than sorry.

Anyone with an Uber account is strongly urged to change the password for it. Use something unique and that includes upper and lower case letters, as well as numbers and special characters. Don’t reuse one from another account. Hackers really do like to reuse passwords on other sites and they are surprisingly successful at it.

Next, carefully monitor payment card statements for the card(s) used with the Uber service. If anything looks suspicious, report it to the card issuer immediately for resolution. Although Uber has not disclosed that payment card information was stolen, the fact that executives went to so much trouble to hide this breach makes it worthwhile to be extra cautious. If you use a third-party payment service, such as PayPal to pay for your Uber rides, change the password for that account too and for any other linked accounts.

So now, in the words of Paul Harvey, the rest of the story. Or at least what we know right now.

Once the perpetrators got their payout from Uber to keep quiet, they were hunted down by Uber and forced to sign non-disclosure agreements to keep it under wraps. Then they disguised the payout as part of a bug bounty. This is what technology companies pay people to help find weaknesses in their products. Once they find a weakness, they pay the finder in hopes that they got to it before it was exploited by bad actors.

All of this is important, not because it’s front-page news. It’s because it’s a stark reminder that even supposedly “mundane” incidents where only names and email addresses were accessed can cause downstream harm. The information from this attack can lead to additional specific phishing attacks. Everyone is urged to watch for those, particularly around the holidays when phishing increases anyway. Watch for offers of steeply discounted products and services. If it sounds too good to be true, it very probably is. Don’t click on links or attachments in those messages.

Also, be on the lookout for phony messages claiming to be from Uber asking you to update your personal information. If you get one, just go directly into your Uber account and change or verify information there. It’s likely this breach may lead to phishing like that too.