Uber Admits To 2016 Data Breach Cover-Up, Enters Agreement: DOJ

SAN FRANCISCO, CA — Uber admitted to covering up a 2016 data breach, during which hackers gained access to nearly 60 million user records and hundreds of thousands of drivers' license numbers.

The admission is part of a non-prosecution agreement between Uber Technologies, Inc. and federal prosecutors, U.S. Department of Justice authorities announced Friday.

"As part of a non-prosecution agreement to resolve the investigation, Uber admitted to and accepted responsibility for the acts of its officers, directors, employees, and agents in concealing its 2016 data breach from the Federal Trade Commission (“FTC”), which at the time of the 2016 breach had a pending investigation into the company’s data security practices," the U.S. Attorney's Office said in a news release.

The company will have to pay $148 million in settlement fees and agreed to implement a new corporate integrity program, data security safeguards and data breach notification plans, among other mandated reforms, authorities said.

Hackers responsible for the 2016 breach used stolen credentials to access a private source code repository and obtain a private access key. The hackers then used that key to access and copy large quantities data associated with Uber's users and drivers, including approximately 57 million user records and 600,000 drivers' license numbers.

Uber did not report the breach until approximately one year later, the DOJ said, when new executive leadership had taken over.

This new leadership disclosed the breach to affected drivers, the public, law enforcement and to foreign and domestic regulators, including state attorneys general and the FTC.

Bay City News contributed to this report.