Uber is now confront problematic dubiousness from Congress over a data breach last year that affectedas many as 57 million drug user and driver account . It was revealed last week that the ride - hailing ship’s company paid $ 100,000 to hackers who accessed the user data in exchange for their silence .
The incident , which occurred more than a twelvemonth ago and was preserve under wrapping , has raised concerns about what a responsible revealing should look like in the backwash of a major security breach . Furthermore , questions linger over whether Uber was acting in the honest interest of its users or whether it was mostly implicated about its own image when it paid the hackers to blue-pencil the stolen data .
The steal data , which included electronic mail addresses , phone numbers , and driver ’s licence numbers , was get word by hackers on an Amazon server , which they accessed using credential come up from a private GitHub web site used by Uber software package technologist . Although it could be argued that handing over $ 100,000 to cyberpunk is a small Mary Leontyne Price to pay — the so scream “ price of doing business”—there does n’t seem to be any imaginable way that Uber could ’ve see that the hackers really deleted the data point after receiving their hush money .
Both Joe Sullivan , Uber ’s chief security measure officer , and Craig Clark , a attorney who reported to him , were fired because of the incident . On Thursday it was account that Uber ’s novel CEO , Dara Khosrowshahi , who took over for Travis Kalanick following a cosmic string of scandals , became cognizant of the breachtwo weeks after becoming CEO . However , Uber waited for an extra two calendar month to give away the incident .
https://gizmodo.com/uber-s-new-ceo-was-told-about-the-companys-massive-data-1820722228
Now , both Democrats and Republicans in Congress are pressuring Uber to reveal further details behind the “ worrisome ” reports of how the ship’s company handle the nag .
In a letter Monday , Sen. Mark Warner , the ranking Democrat on the Senate Banking Subcommittee on Securities , Insurance and Investment , wrote that he had “ grave concerns ” about the breach , which touch on jillion . Uber ’s doings , he said , “ raises serious interrogative sentence about the company ’s compliance with state and Union regulations . ”
Most states havespecific laws in place for handling datum breacheson this graduated table , which includes a patchwork of telling requirements . In some states , public notification is required within 30 days of when the company watch of the breach and may even ask the party to notify the media when a considerable turn of consumers are impacted . In California , for example , a company involved in a major breach is required to “ prominently ” Emily Post info about the break on its web site .
Below are just a few of the enquiry to which Sen. Warner has ask Uber ’s Khosrowshahi to respond ( read Warner’sfull missive here ):
harmonize to reports , Uber ’s systems were break after the attackers discovered log - in credentials to an AWS account used to handle payment . Why were n’t more robust access management mechanism , including strong multi - factor authentication , enable to prevent unauthorized access to passenger and driver data point ?
Who conducted the initial investigation for Uber that successfully key the hackers ? What “ authority ” were provided by the hackers to prove they did , in fact , blue-pencil the compromised data ?
Unlike ransomware payment , in which payment is made to go back or regain access to unaccessible data point or system , it seem the motivating behind this payment was in the main to prevent the world or self-assurance from teach of the breach . What rationale was provided by senior executive director for covering up this breach ?
Sen. John Thune , who chairs the Senate Commerce Committee , also ship a letter on Monday , co - sign by three other lawmakers , including Sen. Orrin Hatch , Republican of Utah and chairman of the Senate Finance Committee . The Republicans ’ letter alike request specifics regarding when Uber first learn of the taxicab , what stride Uber has taken to give notice victims , and who authorized the payments to conceal the taxi . ( Read Thune’sfull varsity letter here . )
“ [ T]he nature of the selective information presently recognize to have been compromised , together with the allegation that the company concealed the breach without apprize affected drivers and consumers , and prior seclusion business concern at Uber , make this a serious incident that merits further scrutiny , ” the lawmakers wrote .
Mark WarnerUber
Daily Newsletter
Get the right technical school , science , and polish news in your inbox daily .
news show from the future , delivered to your present .
You May Also Like
