Skip to main content

Inside the hack Uber didn’t want 57 million users to know about

The man responsible for the Uber hack is reportedly a 20-year-old Floridian

Uber app on a smartphone.
Another day, another massive data breach. This time around, Uber was the target, but unlike other hacks, it took the company more than a year to disclose the hack to its customers.

More information is now coming to light about the attack, and Reuters reports that the culprit was a 20-year-old Florida man. As previously reported, this individual was then paid to destroying the evidence of the attack by way of a bug bounty program. While bug bounties are generally paid to folks who discover small vulnerabilities in a company’s code, this was clearly something much larger and more insidious.

A HackerOne executive noted that the alleged $100,000 payment could be an “all-time record.” Other security experts noted that paying a hacker who had committed a crime by stealing data would be highly unusual, particularly for a bug bounty program where computer scientists are typically paid somewhere between $5,000 and $10,000.

According to a blog post from Uber, hackers managed to steal the personal data of a whopping 57 million Uber users in a data breach. Among those compromised, according to a Bloomberg report, were 7 million drivers, of which around 600,000 had their drivers license numbers stolen. Uber says that the information did not include things like Social Security numbers or credit cards.

Uber didn’t keep the hack under wraps because it didn’t know about it, however. The Bloomberg report notes that former Uber CEO and co-founder Travis Kalanick was alerted to the breach in November 2016, only a month after the hack took place. An additional report from The Wall Street Journal further revealed that Uber’s new CEO Dara Khosrowshahi was alerted to the breach in early September, two weeks after he officially stepped in as the head of the company. Once he learned of the hack, he is said to have “immediately ordered an investigation, which he wanted to complete before making the matter public.”

At the time of the hack, Uber was already negotiating with investigators for separate privacy violation claims — and it still failed to report the hack.

“None of this should have happened, and I will not make excuses for it. While I can’t erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes,” said Khosrowshahi, who took over in September, in the blog post. “We are changing the way we do business.”

Despite concealing the hack for a year, it does seem as though Uber is telling the truth in saying that it’s “changing the way it does business.” Bloomberg reports that the company ousted Joe Sullivan, its chief security officer, and one of Sullivan’s deputies for their roles in covering up the data breach, which is at least a first step in changing its ways. The Uber blog mentioned that “two of the individuals that led the response to this incident are no longer with the company.”

This is not the first massive data breach of the year. Earlier in 2017, credit reporting agency Equifax was breached, potentially putting at risk the information of a whopping 143 million U.S. residents. The hack itself took place sometime between May and July, but was disclosed in September.

Update: The Uber hacker is reportedly a 20-year-old Florida man. 

Editors' Recommendations

Lulu Chang
Former Digital Trends Contributor
Fascinated by the effects of technology on human interaction, Lulu believes that if her parents can use your new app…
7 things you didn’t know you could do in Gmail
Google Press Photo of Google products

Gmail is up there as one of the world's most well-known email services, so you're likely already familiar with the basic functionality of it, whether that's sending important reports for work or sharing silly cat photos with friends. However, there are some features hidden in Gmail that you may not know exist.

Did you know that you could send disappearing emails or make Gmail feel a bit more like Outlook, directly through Gmail on the web? We got you covered with the secrets. Here are seven things you didn't know you could do in Gmail.
Send self-destructing emails

Read more
6 things you didn’t know you could do in Microsoft Teams
A close-up of someone using Microsoft Teams on a laptop for a videoconference.

Microsoft Teams is in use by 145 million daily active users, and there's a decent chance that you're one of them. From voice and video calls to chats and meetings, there are a lot of things that Microsoft Teams can do for you.

Even so, did you know there are some secrets in Teams that you might not be aware of? We've sorted through all of Teams' menus and settings and have collected six of these for you below.
Get together in a meeting with Microsoft Whiteboard
How to use Whiteboard in Microsoft Teams

Read more
7 things you didn’t know your Pixel phone could do
Google Pixel 5

Google's Pixel phones have long been hailed as the best way to get a stripped-back, responsive Android experience. Google offers a few different Pixel phones at different price points, but they generally fall in the midrange to "premium midrange" price bracket -- and they're among the best phones in that price bracket.

But while Pixel devices offer a near-stock Android experience, they're not completely devoid of personality. Google has added a number of features to Pixel phones that make them easier to use and more versatile.

Read more