Uber fined £385,000 for losing UK customer data

[Weebarra]

Content source

https://www.bbc.co.uk/news/technology-46357001

Uber has been fined £385,000 for letting hackers steal data on 2.7 million UK customers. The full names, addresses and phone numbers of users went astray in the 2016 attack. The data had been stolen thanks to "avoidable data security flaws", said the Information Commissioner's Office. Uber has also been fined 600,000 euros (£532,000) by data regulators in Holland over the same breach, as it also affected 174,000 Dutch customers.
Data destruction
"This was not only a serious failure of data security on Uber's part but a complete disregard for the customers and drivers whose personal information was stolen," said Steve Eckersley, director of investigations at the ICO. Uber had done nothing to alert people that data had been downloaded or to support people affected, he added. Customers whose data had been stolen had been left at "increased risk of fraud", he said. The details on 2.7 million customers were part of a massive cache of information on 57 million people taken by the hacker group in October and November 2016. Uber paid the attackers $100,000 (£78,400) to destroy the data they took. Paying the hackers and then saying nothing about it was "not an appropriate response to the cyber-attack", said Mr Eckersley. In response, Uber said it had changed how it handled data since 2016 and now employed a chief privacy officer and a data protection head who oversaw its operations. It added: "We've made a number of technical improvements to the security of our systems both in the immediate wake of the incident as well as in the years since." "We're pleased to close this chapter on the data incident from 2016," it said.
In the US, Uber paid $148m to settle federal charges over the 2016 breach.

 

[ChemicalB]

Proper punishment for one of the worst scandals and lets say if the thing had occurred after the entry of the GDPR, Uber would have risked a maxi-fine of 4% of its worldwide turnover.

 

[Eddie Morra]

Proper punishment for one of the worst scandals and lets say if the thing had occurred after the entry of the GDPR, Uber would have risked a maxi-fine of 4% of its worldwide turnover.

I say penalise them by enforcing the GDPR violation consequences despite it being done before it was activated and see who will be ignoring good security measures then... LOL

 

[ChemicalB]

I say penalise them by enforcing the GDPR violation consequences despite it being done before it was activated and see who will be ignoring good security measures then... LOL

+1

 

[Weebarra]

Personally i think the UK authorities should have fined them more. When you look at what the Dutch authorities fined them for 170,000 customers details being compromised compared to the 2.7 million UK customers then i think the fine should have been comparable but who am i to decide

(Incidentally, i saw my first Uber car the other day in the city, still don't know anyone who has used one though )