March 5, 2018
Uber faces potential $13.5 million lawsuit over data breach from Pennsylvania attorney general
PHILADELPHIA — Pennsylvania’s attorney general is suing the ride-hailing company Uber, saying it broke state law when it failed to notify thousands of drivers for a year that hackers stole their personal information.
The lawsuit filed Monday in Philadelphia said hackers stole the names and drivers’ license numbers of at least 13,500 Pennsylvania Uber drivers. It accuses Uber of violating a state law to notify victims of a data breach within a “reasonable time frame.”
That specific law enables the Attorney General’s office to seek up to $1,000 for each violation
Uber acknowledged in November that for more than a year it covered up a hacking attack that stole personal information about more than 57 million customers and drivers. Pennsylvania’s lawsuit seeks civil penalties in the millions of dollars.
“Uber violated Pennsylvania law by failing to put our residents on timely notice of this massive data breach,” Shapiro said in a press release. “Instead of notifying impacted consumers of the breach within a reasonable amount of time, Uber hid the incident for over a year – and actually paid the hackers to delete the data and stay quiet. That’s just outrageous corporate misconduct, and I’m suing to hold them accountable and recover for Pennsylvanians.”
Uber says it’s taken steps to be accountable and is cooperating with Pennsylvania investigators. Washington state and Chicago have also sued Uber.