Uber surprised by lawsuit by Pennsylvania attorney general in data breach
A lawsuit filed Monday against Uber by Pennsylvania's attorney general surprised the ride-hailing and technology giant.
Attorney General Josh Shapiro sued Uber for taking a year to notify thousands of drivers that hackers stole their personal information.
The lawsuit could force Uber to pay up to $13.5 million in penalties.
Shapiro said Uber violated a Pennslyvania law requiring notice to people affected by data breaches within a “reasonable time.”
“Instead of notifying impacted consumers of the breach within a reasonable amount of time, Uber hid the incident for over a year – and actually paid the hackers to delete the data and stay quiet,” Shapiro said in a statement. “That's just outrageous corporate misconduct, and I'm suing to hold them accountable and recover for Pennsylvanians.”
Uber could be on the hook for $1,000 for each of the at least 13,500 drivers affected, according to Shapiro's office.
Tony West, Uber's chief legal officer, said the lawsuit caught him by surprise. West, who took over legal affairs for Uber in November, said he has reached out to Shapiro and his team pledging Uber's cooperation.
“While I was surprised by Pennsylvania's complaint this morning, I look forward to continuing the dialogue we've started as Uber seeks to resolve this matter. We make no excuses for the previous failure to disclose the data breach,” West wrote in a statement to the Tribune-Review. “I've been up front about the fact that Uber expects to be held accountable; our only ask is that Uber be treated fairly and that any penalty reasonably fit the facts.”
West wrote — and noted that he was not trying to minimize the situation — that while driver's license numbers were exposed in the hack, more sensitive information such are credit card or social security numbers were not.
Joe Grace, a spokesman for Shapiro's office said the attorney general stands by the lawsuit. The office noted that the theft of driver's license number may leave people vulnerable to identify theft. Driver's license numbers can be used to open credit cards and are often sold on the dark web to cyber criminals, the office wrote in a press release.
“The more personal information these criminals gain access to, the more vulnerable the person whose information was stolen becomes,” Shapiro said in the statement.
Washington state and Chicago has also sued Uber.