Uber Paid Hackers $100,000 to Hide Cyber Attack

And if that’s not enough, according to Bloomberg’s report, the San Francisco-based company also has other open cases in the U.S. for “possible bribes, illicit software, questionable pricing schemes and theft of a competitor’s intellectual property”.

Being driven to dark alleys

Focusing on the case involving the cyber attacks, 50 million real names, email addresses and phone numbers were stolen by hackers, alongside seven million drivers’ IDs and license numbers – 600,000 of which in the U.S. alone. Seeing such a shocking number it’s a miracle that Social Security numbers, credit card information or details about trip locations were not taken – at least according to Uber.

The most recent hack was conducted exploiting a weak point in the company’s GitHub, a software code developing platform Uber’s software engineers rely on, resulting in the immediate exposure of login credentials needed to access their Amazon Web Services account. From there it was child’s play for the hackers to gather the necessary info to ask Uber for a ransom. Up to that point the hacking seemed to be another case of a careless company being attacked by extremely lucky wrongdoers. But there was an unexpected – and downright shameful – turn of events: Uber’s executives tried to cover up the ransom as a payment made to ethical hackers who were hired to invade the company’s servers for testing purposes – a reward known as a bug bounty.

Travis Kalanick, the then-CEO of Uber knew about the hack one month after it happened but decided not to report to authorities and especially not to the app’s clientele. Despite the cover-up, he was forced to resign as CEO in June 2017; however, regardless of the gravity of this scandal he still remained in the company’s board – and has remained there to this day. That doesn’t mean there were no consequences, though: Joe Sullivan, former top security official at Facebook and renowned federal prosecutor, was fired from his position of CSO when the case came to public in November 2017.

Another practical measure to be taken is providing the exposed drivers with credit monitoring and free protection for identity theft. This may not seem much, but proper protection is vital to avoid situations similar to the ones occurring right after the 2014 hacker attack when criminals applied for credit using one of the compromised drivers’ name or when a driver saw his IRS tax refund denied due to a fraudulent return filed in his name.

The future seems to hold some serious changes for Uber, but only time will tell whether the company’s credibility will be further affected in a positive or a negative way.