Jaap Arriens/Getty Images Uber has reached a settlement with all 50 US states and the District of Columbia over a 2016 data breach the ride-hailing service failed to disclose. The company will pay a $148 million fine that will be distributed in varying amounts across all states, attorneys general said Wednesday. Uber will also be required to adopt several new data security practices. "Uber's decision to cover up this breach was a blatant violation of the public's trust," Attorney General Becerra said in a statement. "The company failed to safeguard user data and notify authorities when it was exposed. Consistent with its corporate culture at the time, Uber swept the breach under the rug in deliberate disregard of the law." In October 2016, hackers were able to breach Uber's system and steal data on 57 million drivers and riders. The pilfered data included personal information such as names, email addresses and driver's license numbers, but not Social Security numbers and credit card information. Uber then paid $100,000 to the data thieves to delete the information. The issue for the state attorneys general was that Uber waited for more than a year to disclose the hack. The law requires companies to notify customers of data breaches. "Uber failed to notify law enforcement and the public of the breach," Becerra said at a press conference Wednesday. "Protecting the privacy of their customers isn't only the right thing to do, it's the law." Initially, Uber didn't reveal any details about the hacker or how it paid him the money. But it was later reported that a 20-year-old Florida man was responsible for the breach. The payment was reportedly made through a program designed to reward bug hunters who report flaws in a company's software. The breach happened under the watch of Uber's former CEO, Travis Kalanick. The company's new CEO, Dara Khosrowshahi, said he didn't learn of the breach himself until shortly before it was disclosed to the public. "None of this should have happened, and I will not make excuses for it," Khosrowshahi said at the time. "While I can't erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes." Now what Of the 57 million people affected by the data breach, 600,000 were drivers for Uber. The company said drivers' names, email addresses, cell phone numbers and driver's license numbers were likely stolen. When it came to riders, however, just their names, email and phone numbers were possibly taken. Uber will be paying portions of the $148 million to all 50 states partially based on how many drivers were affected. In California, information on 174,000 drivers was breached, so that state will receive $26 million, according to Becerra. Each state will decide on its own how to use the money. "I'm pleased that we've reached an agreement with the attorneys general," Uber Chief Legal Officer Tony West said in a statement. "The commitments we're making in this agreement are in line with our focus on both physical and digital safety for our customers." Over the last year, West prioritized meetings with attorneys general across the US, according to a source familiar with the negotiations. He also hired a chief privacy officer, chief compliance officer and chief security officer to focus on safety and security improvements for the company. In addition to the fine, the settlement also requires Uber to adopt several data security and privacy practices to "prevent future breaches and to reform Uber's corporate culture," according to Becerra. These include notifying users of breaches concerning their personal information, protecting data stored on third-party platforms and implementing strong password policies for access to the company's network. The settlement also calls for Uber to hire an "outside qualified party" to assess its data security efforts on a regular basis, and to create a "corporate integrity program" that includes a hotline for Uber employees to report any ethics concerns. "We know that earning the trust of our customers and the regulators we work with globally is no easy feat. After all, trust is hard to gain and easy to lose," West said. "We'll continue to invest in protections to keep our customers and their data safe and secure, and we're committed to maintaining a constructive and collaborative relationship with governments around the world." First published Sept. 26, 9:51 a.m. PT. Updates, 10:47 a.m.: Adds comment from California Attorney General Xavier Becerra and Uber Chief Legal Officer Tony West; 12:48 p.m.: Includes additional background information and additional comments from Becerra and West. The Smartest Stuff: Innovators are thinking up new ways to make you, and the things around you, smarter. CNET Magazine: Check out a sampling of the stories you'll find in CNET's newsstand edition.<doc-sep>CHICAGO — Uber has agreed to pay $148 million and take steps to tighten data security, after the ride-hailing company failed for a year to notify drivers that hackers had stolen their personal information. Illinois Attorney General Lisa Madigan announced the settlement Wednesday between Uber Technologies Inc. and all 50 states and the District of Columbia. "Uber completely disregarded Illinois' breach notification law when it waited more than a year to alert people to a serious data breach," Madigan said. Madigan said that although Uber is now taking appropriate steps, "the company's initial response was unacceptable. Companies cannot hide when they break the law." Uber learned in November 2016 that hackers had accessed personal data, including driver's license information, for roughly 600,000 Uber drivers in the U.S. The company acknowledged the breach in November 2017, saying it paid $100,000 in ransom for the stolen information to be destroyed. Tony West, chief legal officer for Uber, said the decision by current managers was "the right thing to do." "It embodies the principles by which we are running our business today: transparency, integrity, and accountability," West said. The hack also took the names, email addresses and cell phone number of 57 million riders around the world. All 50 states and the District of Columbia sued Uber, saying the company violated laws requiring it to promptly notify people affected by the breach.<doc-sep>Uber has agreed to pay $148 million to settle a data breach that affected some 57 million customers in 2016. The agreement was with the attorneys general of all 50 states and the District of Columbia to resolve their legal inquiries on this matter, Uber’s chief legal officer Tony West said in a statement released Wednesday. The data breach affected 50 million riders and 7 million drivers; around 600,000 driver license numbers for U.S. drivers were also included in the breach. Uber’s response and cover up of the breach led to the firing of Joe Sullivan, the company’s chief security officer at the time. Uber didn’t report the incident that occurred in October 2016. Instead, the company paid hackers $100,000 to get rid of the evidence and keep the data breach a secret, which Bloomberg first reported. The data breach and ensuing cover up was revealed in November, more than a year after it had occurred and just a few months after Dara Khosrowshahi had taken the CEO position. West noted that Uber (and in Khosrowshahi’s first year as CEO) has worked to improve safety and security following the scandal. For instance, Uber hired in 2018 Ruby Zefo as chief privacy officer and Matt Olsen as chief trust and security officer. The hiring of Zefo, who led Intel’s global privacy and security legal team, and Olsen is part of the company’s mission to move past the embarrassing data breach, as well as other weak privacy practices employed by former CEO Travis Kalanick, who resigned in 2017 after a string of scandals. In April, Uber expanded a proposed settlement made with the Federal Trade Commission pertaining to data mishandling, privacy and security complaints that date back to 2014 and 2015. That proposed settlement happened prior to Uber’s disclosure of the 2016 data breach.<doc-sep>
California Attorney General Xavier Becerra and San Francisco District Attorney George Gascón announced on Wednesday (Sept. 26) that they have reached a settlement with Uber Technologies Inc., in which Uber will pay $148 million to resolve allegations that it violated state laws pertaining to data breach reporting. In a press release, the two AGs said the settlement also covers charges that Uber violated reasonable data security laws with its 2016 breach of driver and customer information. Uber is accused of exposing the data of 57 million users and paying hackers to hide the breach instead of reporting it to law enforcement and regulators. “Uber’s decision to cover up this breach was a blatant violation of the public’s trust,” said Becerra in the press release announcing the settlement. “The company failed to safeguard user data and notify authorities when it was exposed. Consistent with its corporate culture at the time, Uber swept the breach under the rug in deliberate disregard of the law. Companies in California and throughout the nation are entrusted with customers’ valuable private information. This settlement broadcasts to all of them that we will hold them accountable to protect their data.” The nationwide settlement, which California helped to lead, calls for a $148 million penalty payment by Uber, benefiting all 50 states and the District of Columbia. California will divide its $26 million share of the settlement between the California Attorney General’s Office and the San Francisco District Attorney’s Office, the two said in the press release. The settlement also includes additional terms to prevent future breaches and to reform Uber’s corporate culture. “We wholeheartedly support innovative business models, but new ways of engaging in business cannot come at the expense of public safety or consumer privacy,” said Gascón. “This settlement today demonstrates what happens when all of us in law enforcement work together. My office will continue to collaborate closely with the Attorney General to protect consumers both in San Francisco and the rest of California.”