Uber Reaches $148 Million Settlement for 2016 Data Breach

Uber reached a $148 million settlement with all 50 states and the District of Columbia on the company’s yearlong delay in reporting a data breach affecting some 600,000 drivers and riders (see 1804120056), Missouri Attorney General Josh Hawley (R) announced Wednesday. Uber learned about the breach in November 2016 but didn’t report it until November 2017, said Hawley. “Even though some of that information triggered Missouri law requiring Uber to notify affected Missouri residents, Uber failed to report the breach in a timely manner,” Hawley’s office said. Affected Missouri drivers are eligible for $100 in compensation, Hawley said. “Instead of notifying impacted consumers of the breach within a reasonable amount of time, Uber hid the incident for over a year – and actually paid the hackers to delete the data and keep quiet,” Pennsylvania AG Josh Shapiro (D) said. “That is outrageous corporate misconduct.” Uber will "continue to invest in protections to keep our customers and their data safe and secure, and we’re committed to maintaining a constructive and collaborative relationship with governments around the world," Uber Chief Legal Officer Tony West said Wednesday.