W<\/span>hen<\/strong> Uber\u00a0paid a $100,000 ransom<\/a>\u00a0so that hackers who broke into its data warehouse would destroy the personal information they stole, it allowed the ride-sharing company to keep a massive breach of 57 million user and driver accounts secret for nearly a year.<\/span><\/p>\n

Now that secret decision could come to haunt Uber. State and national governments around the world are investigating whether the company violated laws requiring the disclosure of major breaches to customers and legal authorities. It also raises questions about the ongoing practice of paying off hackers, which some experts warn encourages criminals to keep on hacking away at major corporations and the consumers who\u2019ve entrusted them with their personal information.<\/span><\/p>\n

<\/a><\/p>\n

IS YOUR UBER DATA SAFE?<\/strong><\/span><\/p>\n

Uber spokesman Matthew Wing would not comment when asked how the company knows that the hackers destroyed the data they obtained, nor would he comment on other technical or legal issues. Instead, he deferred to new CEO Dara Khosrowshahi\u2019s blog posting announcing the breach on Tuesday.<\/span><\/p>\n

Uber has said that for riders, hackers got only names, email addresses and telephone numbers. They did not get personally identifiable information such as trip details or credit card and Social Security numbers.<\/span><\/p>\n

For about 600,000 U.S. drivers, the hackers obtained driver\u2019s license numbers, and the company has offered them free credit monitoring services, the company has said.<\/span><\/p>\n

HOW DID THE BREACH HAPPEN?<\/strong><\/span><\/p>\n

The October 2016 hack started at the software repository GitHub, a platform where developers can go to host and review each other\u2019s code.<\/span><\/p>\n

Uber hasn\u2019t explained how its developers\u2019 private account on the site was compromised, but it likely involved some carelessness, said Kyle Flaherty of security firm Rapid7.<\/span><\/p>\n

\u201cIt\u2019s like any other account you have,\u201d Flaherty said. \u201cBe stringent with your own credentials and be aware of other login credentials that might be inside the repository itself, whether it\u2019s in the code or elsewhere<\/span>.\u201d\u00a0Bloomberg reported<\/a>\u00a0that two Uber developers had stashed credentials for the company\u2019s data stores in their code on GitHub.<\/span><\/p>\n

GitHub said Wednesday that the breach was not the result of a failure of its own security, but declined further comment. It also reiterated that it recommends against storing access tokens, passwords or other authentication or encryption keys in code stored on the site \u2014 and warned developers who do so to use extra safeguards to prevent unauthorized access.<\/span><\/p>\n

TO PAY RANSOMS OR NOT<\/strong><\/span><\/p>\n

While many security experts have criticized Uber for paying off the hackers with a ransom \u2014 which the company later categorized as a more acceptable \u201cbug bounty\u201d awarded to security researchers \u2014 others saw the $100,000 payment as a relative bargain that also successfully secured users\u2019 data.<\/span><\/p>\n

<\/a><\/p>\n

\u201cUber paid $100K to protect 57M people? Good,\u201d\u00a0tweeted<\/a>\u00a0Dan Kaminsky, chief scientist at security firm White Ops. \u201cI think people forget the goal is actually to prevent harm. Yeah, those hackers could totally have kept the data. But then, their identities were known, and they knew they might face consequences. Not ideal, welcome to the real.\u201d<\/span><\/p>\n

COVERING IT UP<\/strong><\/span><\/p>\n

The bigger problem for Uber \u2014 and its users \u2014 is not so much the payment as the secret manoeuvres to keep it hidden, Flaherty said.<\/span><\/p>\n

\u201cBeing open and honest about these types of things is usually the best way to go,\u201d he said. \u201cThat\u2019s the only way this stuff is going to change overall.\u201d<\/span><\/p>\n

Now, though, in addition to yet another hit to its reputation with consumers, Uber faces a mountain of legal hurdles as state prosecutors launched investigations Wednesday and members of Congress called on the Federal Trade Commission to take action.<\/span><\/p>\n

GOVERNMENT RESPONSE<\/strong><\/span><\/p>\n

Many U.S. states have laws requiring that companies notify local authorities and consumers if data is stolen. As of Wednesday, attorneys general in New York, Massachusetts and Missouri had announced investigations.<\/span><\/p>\n

Massachusetts AG Maura Healey, a Democrat,\u00a0said Wednesday<\/a>\u00a0she has requested documents and other information from the ride-hailing service, adding her office is \u201ckeeping all criminal and civil options on the table.\u201d<\/span><\/p>\n

The breach will also have repercussions outside the United States.<\/span><\/p>\n

Follow us on TWITTER for more Logistics News<\/a><\/strong>\u00a0 \u00a0 \u00a0\u00a0Follow us on FACEBOOK for more Logistics News<\/a><\/strong><\/p>\n

British officials said Wednesday that any fine against Uber for its large-scale data breach will be higher than usual because the firm did not promptly disclose the hack. Britain\u2019s Deputy Information Commissioner James Dipple-Johnstone said that \u201cif U.K. citizens were affected then we should have been notified so that we could assess and verify the impact on people whose data was exposed.\u201d<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

When Uber\u00a0paid a $100,000 ransom\u00a0so that hackers who broke into its data warehouse would destroy the personal information they stole, it allowed the ride-sharing company to keep a massive breach of 57 million user and driver accounts secret for nearly a year. Now that secret decision could come to haunt Uber. State and national governments…<\/p>\n","protected":false},"author":6,"featured_media":4591,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[29,1,47],"tags":[],"_links":{"self":[{"href":"https:\/\/moovafrica.com\/news\/wp-json\/wp\/v2\/posts\/7061"}],"collection":[{"href":"https:\/\/moovafrica.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/moovafrica.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/moovafrica.com\/news\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/moovafrica.com\/news\/wp-json\/wp\/v2\/comments?post=7061"}],"version-history":[{"count":1,"href":"https:\/\/moovafrica.com\/news\/wp-json\/wp\/v2\/posts\/7061\/revisions"}],"predecessor-version":[{"id":7062,"href":"https:\/\/moovafrica.com\/news\/wp-json\/wp\/v2\/posts\/7061\/revisions\/7062"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/moovafrica.com\/news\/wp-json\/wp\/v2\/media\/4591"}],"wp:attachment":[{"href":"https:\/\/moovafrica.com\/news\/wp-json\/wp\/v2\/media?parent=7061"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/moovafrica.com\/news\/wp-json\/wp\/v2\/categories?post=7061"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/moovafrica.com\/news\/wp-json\/wp\/v2\/tags?post=7061"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}