Taxi-hailing firm warned it may face higher fines as inquiry continues into whether UK customers’ details were compromised

This article is more than 2 years old

This article is more than 2 years old

UK authorities were unaware of a mass data breach at Uber that potentially put British customers’ personal details into the hands of cyber criminals.



Downing Street said the hack, which affected 57 million customers and drivers worldwide, had not been reported by the taxi-hailing firm.

Security services and the information watchdog have been trying to assess the scale of the damage amid warnings Uber’s secrecy could result in higher fines.

Timeline A timeline of Uber's terrible year Show Hide

#DeleteUber goes viral Uber’s decision to lift surge pricing during a New York taxi drivers’ work stoppage in protest of the Trump travel ban prompts a viral #DeleteUber campaign. Susan Fowler speaks out Former Uber engineer Susan Fowler publishes a blog post with allegations of widespread sexual harassment and gender discrimination. Greyball deception revealed The New York Times exposes Uber’s use of Greyball, a tool to systematically deceive authorities in cities where Uber was violating local laws. Drivers underpaid by millions Uber admits it has for years been underpaying New York City drivers by tens of millions of dollars. Toxic culture reaches breaking point, Kalanick resigns Uber fires 20 employees following the conclusion of an investigation into sexual harassment and workplace culture. Uber is sued by an Indian passenger who was raped by an Uber driver after reports reveal that a top executive had obtained the woman’s medical records, allegedly in order to cast doubt upon her account. CEO Travis Kalanick resigns. Unsafe cars leased in Singapore The Wall Street Journal reports that Uber had rented fire-prone cars to drivers in Singapore, despite knowing that the vehicles had been recalled over serious safety concerns. Uber loses London license Uber loses its license to operate in London due to a lack of corporate responsibility. The company is appealing the decision. Massive hack cover-up revealed Uber admits concealing a 2016 breach that exposed the data of 57 million Uber customers and drivers, failing to disclose the hack to regulators or affected individuals. The company paid a $100,000 ransom to the hackers to destroy the information and keep the breach quiet.

Uber said it could not yet confirm how many customers in the UK had their details compromised.

News of the hack came in an extraordinary admission by the US firm’s chief executive on Tuesday that revealed a third-party server had been infiltrated in late 2016.

A ransom of $100,000 (£75,500) had been paid to hackers so they would delete the data and keep the security lapse quiet.

Stolen information included names, email addresses and mobile phone numbers, as well as the names and number plates of 600,000 drivers in the US.

Theresa May’s official spokesman said: “These are obviously concerning reports and the National Cyber Security Centre is working closely with domestic and international agencies, including the National Crime Agency and the Information Commissioner’s Office, to investigate if and how this breach has affected people in the UK.

“It is a worldwide incident and it is unclear at this stage which countries were affected by the hack. What we do know is, based on current information, we have not seen evidence that financial details have been compromised.”

He added that Uber “did not notify individuals in the UK, the UK government or UK regulators” at the time the hack was discovered in October last year.

The Information Commissioner’s Office warned Uber it could face fines, saying the incident raised “huge concerns around its data protection policies and ethics”.

The tech company reportedly tracked down the hackers and pressured them to sign non-disclosure agreements so news of the incident did not become public.

Company executives had then dressed up the breach as a “bug bounty”, the practice of paying hackers to test the strength of software security, according to the New York Times.

James Dipple-Johnstone, the deputy commissioner of the information watchdog, said: “Uber’s announcement about a concealed data breach last October raises huge concerns around its data protection policies and ethics.

“It’s always the company’s responsibility to identify when UK citizens have been affected as part of a data breach and take steps to reduce any harm to consumers.

“If UK citizens were affected then we should have been notified so that we could assess and verify the impact on people whose data was exposed.

He added: “Deliberately concealing breaches from regulators and citizens could attract higher fines for companies.”

The Uber chief executive, Dara Khosrowshahi, who took over in August, said in a blogpost there had been “no indication” trip history, credit card details, bank account numbers or dates of birth were downloaded by the hackers.

He wrote: “At the time of the incident, we took immediate steps to secure the data and shut down further unauthorised access by the individuals.

“We subsequently identified the individuals and obtained assurances that the downloaded data had been destroyed.”

Data protection lawyers at the Leigh Day legal firm said a huge number of claims could be brought against Uber by its customers as a result of the security failing.



A spokesman for the National Cyber Security Centre said: “Based on current information, we have not seen evidence that financial details have been compromised.”

A spokesman for Transport for London, which this year announced it would not be renewing Uber’s licence in the capital, said: “We are working to gain clarity from Uber on whether any of the issues seen in the US have occurred here.



“We are pressing them for the full details of what has happened so that we can be satisfied that all the right protections are in place for the personal data of drivers and customers in London.”