Uber breach affected 57 million users, covered up for a year
A 2016 Uber breach affecting data for 57 million users was covered up by the company, including a $100,000 payment to the attackers to keep the incident quiet.
Malicious actors stole personal data on hundreds of thousands of Uber drivers and millions of Uber users and the company allegedly covered up the breach for one year, including reportedly paying the attackers to keep quiet.
According to new CEO Dara Khosrowshahi, the Uber breach was due to two malicious actors accessing "a third-party cloud-based service" -- reportedly GitHub and Amazon Web Services (AWS) -- in late 2016 and downloading files containing names and driver's license information on 600,000 U.S. Uber drivers and personal information -- names, email addresses and phone numbers -- for 57 million Uber customers from around the world. According to Bloomberg, which was first to report the Uber breach, the incident was covered up by two members of the company's infosec team.
"None of this should have happened, and I will not make excuses for it. While I can't erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes," Khosrowshahi wrote in a blog post. "We are changing the way we do business, putting integrity at the core of every decision we make and working hard to earn the trust of our customers."
Dara Khosrowshahi
Khosrowshahi said the "failure to notify affected individuals or regulators last year" prompted a number of actions, including firing the two individuals responsible for the Uber breach response -- Joe Sullivan, former federal prosecutor and now ex-CSO at Uber, and Craig Clark, one of Sullivan's deputies -- notifying and offering ID and credit monitoring to the affected drivers, notifying regulators and monitoring the affected customer accounts.
Details of the Uber data breach
According to Bloomberg, the attackers accessed a private GitHub repository used by Uber in October 2016 and used stolen credentials from GitHub to access an archive of information stored on an AWS account.
Terry Ray, CTO of Imperva, said the use of GitHub "appears to be a prime example of good intentions gone bad."
"Using an online collaboration and coding platform isn't necessarily wrong, and it isn't clear if getting your accounts hacked on these platforms is even uncommon. The problem begins with why live production data was used in an online platform where credentials were available in GitHub," Ray told SearchSecurity. "Sadly, it's all too common that developers are allowed to copy live production data for use in development, testing and QA. This data is almost never monitored or secured, and as we can see here, it is often stored in various locations and is often easily accessed by nefarious actors."
Customer distrust of the brand will be amplified by the company's attempts to hide the facts from them and points to the need for change in the industry.
Jim Kennedyvice president North America, Certes Networks
Sullivan reportedly took the lead in the Uber breach response and, along with Clark, worked to keep the incident under wraps, including paying the attackers $100,000 to delete the stolen personal data and to keep quiet.
Khosrowshahi mentioned communication with the attackers in his blog post, but did not admit to any payment being made.
"At the time of the incident, we took immediate steps to secure the data and shut down further unauthorized access by the individuals. We subsequently identified the individuals and obtained assurances that the downloaded data had been destroyed," Khosrowshahi wrote. "We also implemented security measures to restrict access to and strengthen controls on our cloud-based storage accounts."
Jeremiah Grossman, chief of security strategy at SentinelOne, said it can be "difficult, if not impossible, for an organization to lock down" a vector like GitHub.
"Developers accidentally, and often unknowingly, share credentials over GitHub all the time where they become exposed," Grossman told SearchSecurity. "While traditional security controls remain crucial to organizational security, it's no good if individuals with access to private information expose their account credentials in a place where they can be obtained and misused by others."
Willy Leichter, vice president of marketing at Virsec Systems Inc., said if the details of this Uber breach cover-up are verified, it could been extremely damaging for the company.
"This is a staggering breach of customer trust, ethical behavior, common sense and legal requirements for breach notification. Paying hackers to conceal their crimes is as shortsighted as it is stupid," Leichter told SearchSecurity. "If this had happened after the EU GDPR kicks in, Uber would cease to exist. That may be the outcome anyway."
Uber breach ramifications
The 2016 breach is the latest in a long line of issues for Uber. At the time of the incident, Uber was already under investigation for separate privacy violations. The company is also battling various lawsuits from cities and users.
Jim Kennedy, vice president North America at Certes Networks, said Uber's already questionable reputation should take a big hit.
"Most likely the Uber C-suite, seeing the repercussions of cyberattacks on similar household names, were keen to avoid the reputational damage -- a massive error of judgment," Kennedy told SearchSecurity. "The reality is that customer distrust of the brand will be amplified by the company's attempts to hide the facts from them and points to the need for change in the industry."
Adam Levin, cybersecurity expert and founder and chairman of CyberScout, said the Uber breach is another example of the company "placing stock value over and above privacy at the expense of drivers and consumers."
"Uber did a hit and run on our privacy and created a completely avoidable extinction or near-extinction event, and further damaged and already tarnished brand," Levin told SearchSecurity. "As ever, the goal for a company faced with a breach or compromise should be urgency, transparency and above all else, empathy for those affected."
Ken Spinner, vice president of field engineering at Varonis, said the Uber data breach will likely "fire up already angry consumers, who are going to demand action and protection."
"Every state attorney general is going to be salivating at the prospect of suing Uber. While there's no overarching federal regulations in place in the U.S., there's a patchwork of state regulations that dictate when disclosures must be made -- often it's when a set number of users have been affected," Spinner told SearchSecurity. "No doubt Uber has surpassed this threshold and violated many of them by not disclosing the breach for over a year. This is the latest example of how hiding a breach rarely benefits a company and almost surely will backfire."
Dara Khosrowshahi
