Uber Agrees to Expanded Data Breach Settlement With FTC

Uber has agreed to expanded penalties for a 2016 data breach that compromised names and email address of 25 million people, the Federal Trade Commission said Thursday.

Among other changes, the ride-sharing company may now face civil penalties if it fails to notify the FTC of future data breaches, the revised settlement states.

The settlement expands on penalties the company already agreed to for a 2014 data breach.

Uber initially tried to conceal the 2016 breach by paying off the hackers through its bug bounty program, a move that caused some heartburn across the bug bounty community, which is making inroads in government.

Bug bounties are cash rewards organizations offer ethical hackers who find vulnerabilities in their websites, apps and other tools. Bug bounties are typically bound by stringent rules, including prohibitions on compromising any personal information of employees or customers.

In Uber’s case, the hackers compromised a third-party database containing personal information on more than 50 million customers and drivers and Uber executives paid the hackers $100,000 through the bug bounty program in exchange for an agreement to destroy the data.

“The bug bounty program was created to provide financial rewards to parties who responsibly disclose security vulnerabilities rather than those who maliciously exploit vulnerabilities to access consumers’ personal information,” the FTC noted in a news release.

Uber’s new Chief Information Security Officer John Flynn acknowledged during a February hearing before the Senate Commerce Committee that the payment was an improper use of the company’s bug bounty program.

Uber agreed to a settlement with the FTC over its 2014 data breach, which affected about 50,000 drivers, in 2017. That was after the company was aware of the 2016 breach but before it had publicly acknowledged it.

Both the original and revised settlements require Uber to undergo a third-party security audit immediately after the settlement and biannually for 20 years thereafter. The original settlement only required Uber to turn the first audit over to the FTC, but the revised settlement requires the company to turn all the audits over.

The revised settlement also requires Uber to retain records from bug bounty reports related to potential or actual data breaches.

“After misleading consumers about its privacy and security practices, Uber compounded its misconduct by failing to inform the commission that it suffered another data breach in 2016,” acting FTC Chairman Maureen Ohlhausen said in a statement.

“The strengthened provisions of the expanded settlement are designed to ensure that Uber does not engage in similar misconduct in the future,” Olhausen added.

The FTC has pursued numerous companies for failing to secure consumer information in advance of a data breach since a 2015 settlement with Wyndham Hotels and Resorts, which effectively established the commission’s authority in the area.

The commission has pursued cases against the medical testing company LabMD and the infidelity dating site Ashley Madison among others. The company is currently investigating the Equifax data breach, which compromised personal information of roughly 40 percent of Americans.

The proposed settlement with Uber will be available for public comment through May 14. Then commissioners will vote on whether to make it final.