Uber Settles Data Breach Lawsuit With Michigan

LANSING, MI —Uber, the ride-sharing app, has settled a lawsuit with Michigan and 49 other states, and the District of Columbia. The lawsuit stemmed from a 2016 data breach, which the company failed to tell customers about.

Uber will pay $148 million to settle the multi-state lawsuit, $$1,803,472.49 of which will go to Michigan. The company also agreed to maintain a comprehensive data security program to protect the information of Uber riders and drivers.

“Companies have a responsibility to be upfront and transparent with their customers, employees, and stakeholders,” said Michigan Attorney General Bill Schuette. “Uber failed to do that and now they are seeing the consequences of their actions.”

In November 2016, Uber discovered that private information about Uber drivers was accessed by hackers. The information included the full names and driver's license numbers for about 600,000 drivers nationwide. Michigan has laws that require a company hit by a data breach to notify anyone affected.

Uber waited a year to report the data breach, according to Schuette Drivers weren't made aware of the hack until November 2017.

The company's lack of immediate action post-breach led to a lawsuit from a coalition of attorneys general. Uber settled the lawsuit this week.

Uber has agreed to hire a third-party to protect user data. The company will also institute stronger password requirements for drivers, implement a stronger overall data security policy, and will hire an outside company to assess Uber's cybersecurity.

Subscribe to Patch for more regional news and real-time alerts. Connect with Detroit Patch on Facebook. Image via Shutterstock