Uber confirms massive 2016 data breach

Paid hackers and kept breach quiet

Uber has confirmed that in October 2016 hackers gained access to the licence numbers of 600,000 of its US drivers and the personal information of 57 million Uber users from around the world.

The company’s chief executive, Dara Khosrowshahi, said the data included passengers’ names, email addresses and mobile phone numbers.

Khosrowshahi joined the company in August, replacing Uber founder Travis Kalanick as CEO.

“I recently learned that in late 2016 we became aware that two individuals outside the company had inappropriately accessed user data stored on a third-party cloud-based service that we use,” Khosrowshahi said in a statement.

“The incident did not breach our corporate systems or infrastructure.”

Bloomberg, which broke the story, reported that attackers had obtained credentials from a private Uber GitHub repository, which they used to access data stored on Amazon Web Service’s cloud. Uber kept the breach quiet and paid the hackers US$100,000 to delete the data, Bloomberg reported.

The newswire said that Uber chief security officer Joe Sullivan spearheaded the response to the breach and has now been ousted as a result. Uber confirmed that at least two executives have left the company over the handling of the breach.

“At the time of the incident, we took immediate steps to secure the data and shut down further unauthorized access by the individuals,” Khosrowshahi said.

“We subsequently identified the individuals and obtained assurances that the downloaded data had been destroyed. We also implemented security measures to restrict access to and strengthen controls on our cloud-based storage accounts.”

Read more: NCSC’s advanced cyber threat protection saves organisations millions

The CEO said that after learning details of the breach, including the failure to notify the affected individuals and privacy regulators, he has ordered a “thorough investigation” into the company’s response.

The company is notifying regulatory authorities, it said.

Uber said it had seen “no evidence of fraud or misuse tied to the incident”.

Australian Information and Privacy Commissioner Timothy Pilgrim confirmed that his office has commenced inquiries with Uber.

“Incidents such as this are a timely reminder to Australians of the value of the personal information we provide in order to receive products and services,” Pilgrim said.

“As always, I encourage Australians to read privacy notices and ensure they are fully informed about what information is being exchanged in order to get the service, product or app they seek.”

“It is also a timely reminder to Australian businesses and agencies of the reputational value of good privacy practice, and the reputational risks that can follow mishandling of personal data,” he added.

In February 2018, Australia’s new data breach notification scheme comes into effect.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags data breachesdata breach notificationUber

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Rohan Pearce

Rohan Pearce

Show Comments

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Cate Bacon

Aruba Instant On AP11D

The strength of the Aruba Instant On AP11D is that the design and feature set support the modern, flexible, and mobile way of working.

Dr Prabigya Shiwakoti

Aruba Instant On AP11D

Aruba backs the AP11D up with a two-year warranty and 24/7 phone support.

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers


This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang


It really doesn’t get more “gaming laptop” than this.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?