Uber is being sued by the state of Pennsylvania after the ride hailing company failed to notify potential victims for almost a year that hackers had stolen their personal information. The lawsuit was filed by Pennsylvania Attorney General Josh Shapiro on Monday.
According to the lawsuit, which is filed in Pennsylvania, hackers stole the names and driver’s license number of a minimum of 13,500 Pennsylvania Uber drivers in 2016. The lawsuit accused Uber of violating the state law by not informing the victims about the data breach within a “reasonable” time frame.
“Instead of notifying impacted consumers of the breach within a reasonable amount of time, Uber hid the incident for over a year — and actually paid the hackers to delete the data and stay quiet,” state Attorney General Josh Shapiro said in a statement. “That’s just outrageous corporate misconduct, and I’m suing to hold them accountable and recover for Pennsylvanians.”
In November, Uber disclosed that in 2016 hackers had stolen personal information which included names, email addresses, and mobile phone numbers of 600,000 Uber drivers in the U.S. However, the breach did not include any Social Security or credit card information. Uber also stated that there was no evidence of the data being misused. The company also acknowledged paying $100,000 to the hackers for destroying the stolen information.
Uber said that it is cooperating with Pennsylvania investigators. “While we make no excuses for the previous failure to disclose the data breach, Uber’s new leadership has taken a series of steps to be accountable and respond responsibly,” an Uber spokesman said. “While we dispute the accuracy of some of the characterizations in the Pennsylvania attorney general’s lawsuit, we will continue to cooperate with them and ask only that we be treated fairly.”
The Pennsylvania lawsuit is seeking penalties in millions of dollars that would include $1,000 for every violation of consumer protection laws and $3,000 for every violation towards a victim who is 60 years or older.
The states of Washington and Chicago have also filed a lawsuit against Uber, and attorney generals from other states are also investigating this data breach.
