SHARE THIS ARTICLE Share Tweet Post Email 
 
 Hackers stole the personal data of 57 million customers and drivers from Uber Technologies Inc., a massive breach that the company concealed for more than a year. This week, the ride-hailing firm ousted its chief security officer and one of his deputies for their roles in keeping the hack under wraps, which included a $100,000 payment to the attackers. 
 
 Compromised data from the October 2016 attack included names, email addresses and phone numbers of 50 million Uber riders around the world, the company told Bloomberg on Tuesday. The personal information of about 7 million drivers was accessed as well, including some 600,000 U.S. driver’s license numbers. No Social Security numbers, credit card information, trip location details or other data were taken, Uber said. 
 
 “None of this should have happened, and I will not make excuses for it.” 
 
 At the time of the incident, Uber was negotiating with U.S. regulators investigating separate claims of privacy violations. Uber now says it had a legal obligation to report the hack to regulators and to drivers whose license numbers were taken. Instead, the company paid hackers to delete the data and keep the breach quiet. Uber said it believes the information was never used but declined to disclose the identities of the attackers. 
 
 Dara Khosrowshahi Photographer: Matthew Lloyd/Bloomberg 
 
 “None of this should have happened, and I will not make excuses for it,” Dara Khosrowshahi, who took over as chief executive officer in September, said in an emailed statement. “We are changing the way we do business.” 
 
 Read more: Uber Pushed the Limits of the Law. Now Comes the Reckoning 
 
 After Uber’s disclosure Tuesday, New York Attorney General Eric Schneiderman launched an investigation into the hack, his spokeswoman Amy Spitalnick said. The company was also sued for negligence over the breach by a customer seeking class-action status. 
 
 Hackers have successfully infiltrated numerous companies in recent years. The Uber breach, while large, is dwarfed by those at Yahoo, MySpace, Target Corp., Anthem Inc. and Equifax Inc. What’s more alarming are the extreme measures Uber took to hide the attack. The breach is the latest scandal Khosrowshahi inherits from his predecessor, Travis Kalanick. 
 
 Read more: Gadfly’s Shira Ovide says Kalanick must speak 
 
 QuicktakeCybersecurity 
 
 Kalanick, Uber’s co-founder and former CEO, learned of the hack in November 2016, a month after it took place, the company said. Uber had just settled a lawsuit with the New York attorney general over data security disclosures and was in the process of negotiating with the Federal Trade Commission over the handling of consumer data. Kalanick declined to comment on the hack. 
 
 Joe Sullivan, the outgoing security chief, spearheaded the response to the hack last year, a spokesman told Bloomberg. Sullivan, a onetime federal prosecutor who joined Uber in 2015 from Facebook Inc., has been at the center of much of the decision-making that has come back to bite Uber this year. Bloomberg reported last month that the board commissioned an investigation into the activities of Sullivan’s security team. This project, conducted by an outside law firm, discovered the hack and the failure to disclose, Uber said. 
 
 Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. 
 
 A patchwork of state and federal laws require companies to alert people and government agencies when sensitive data breaches occur. Uber said it was obligated to report the hack of driver’s license information and failed to do so. 
 
 “At the time of the incident, we took immediate steps to secure the data and shut down further unauthorized access by the individuals,” Khosrowshahi said. “We also implemented security measures to restrict access to and strengthen controls on our cloud-based storage accounts.” 
 
 Uber has earned a reputation for flouting regulations in areas where it has operated since its founding in 2009. The U.S. has opened at least five criminal probes into possible bribes, illicit software, questionable pricing schemes and theft of a competitor’s intellectual property, people familiar with the matters have said. The San Francisco-based company also faces dozens of civil suits. 
 
 U.K. regulators including the National Crime Agency are also looking into the scale of the breach. London and other governments have previously taken steps toward banning the service, citing what they say is reckless behavior by Uber. 
 
 In January 2016, the New York attorney general fined Uber $20,000 for failing to promptly disclose an earlier data breach in 2014. After last year’s cyberattack, the company was negotiating with the FTC on a privacy settlement even as it haggled with the hackers on containing the breach, Uber said. The company finally agreed to the FTC settlement three months ago, without admitting wrongdoing and before telling the agency about last year’s attack. 
 
 The new CEO said his goal is to change Uber’s ways. Uber said it informed New York’s attorney general and the FTC about the October 2016 hack for the first time on Tuesday. Khosrowshahi asked for the resignation of Sullivan and fired Craig Clark, a senior lawyer who reported to Sullivan. The men didn’t immediately respond to requests for comment. 
 
 Khosrowshahi said in his emailed statement: “While I can’t erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes.” 
 
 The company said its investigation found that Salle Yoo, the outgoing chief legal officer who has been scrutinized for her responses to other matters, hadn’t been told about the incident. Her replacement, Tony West, will start at Uber on Wednesday and has been briefed on the cyberattack. 
 
 Travis Kalanick Photographer: Scott Eells/Bloomberg 
 
 Kalanick was ousted as CEO in June under pressure from investors, who said he put the company at legal risk. He remains on the board and recently filled two seats he controlled. 
 
 Uber said it has hired Matt Olsen, a former general counsel at the National Security Agency and director of the National Counterterrorism Center, as an adviser. He will help the company restructure its security teams. Uber hired Mandiant, a cybersecurity firm owned by FireEye Inc., to investigate the hack. 
 
 The company plans to release a statement to customers saying it has seen “no evidence of fraud or misuse tied to the incident.” Uber said it will provide drivers whose licenses were compromised with free credit protection monitoring and identity theft protection. 
 
 — With assistance by Erik Larson 

 Uber Technologies Inc. on Tuesday revealed it paid hackers $100,000 in an effort to conceal a data breach affecting 57 million accounts one year ago, a disclosure that adds to a string of scandals and legal problems for the world’s most highly valued startup. 
 
 The ride-hailing firm said it fired its chief security officer, Joe Sullivan, and deputy Craig Clark for their roles in the breach and for covering it up. 
 
 In... 

 CLOSE Ride service app Uber is is hot water once again. Time 
 
 epa06219374 An Uber app on a mobile telephone in central London, Britain, 22 September 2017. Transport for London (TFL), the governing body responsible for transport in London, announced on 22 September 2017 that they will not renew Uber's license as a private hire operator in the city. Transport for London has informed Uber London Limited that it will not be issued with a private hire operator licence after expiry of its current licence on 30 September 2017. EPA-EFE/WILL OLIVER ORG XMIT: WO001 (Photo: EPA-EFE) 
 
 SAN FRANCISCO — Personal information belonging to about 57 million Uber customers and drivers was stolen by hackers last October, a breach the company kept hidden for a year and for which its chief security officer was fired this week. 
 
 The stolen data included names, email addresses and phone numbers of 50 million Uber riders and 7 million drivers. The drivers’ stolen information also included 600,000 US. drivers' license numbers, CEO Dara Khosrowshahi said in a statement. 
 
 "You may be asking why we are just talking about this now, a year later. I had the same question," Khosrowshahi wrote. 
 
 After asking for an investigation, Uber discovered that instead of notifying regulators and the affected individuals it had "identified the individuals and obtained assurances that the downloaded data had been destroyed," he wrote. 
 
 More: USA TODAY's list of the biggest data breaches and hacks of all time (Hint: Uber's only #12) 
 
 Bloomberg reported Tuesday afternoon that the company actually paid the hackers $100,000 to delete the data and keep mum about it. 
 
 It’s not unheard of for companies to pay ransom if their computers are locked up due to ransomware, said Ben Johnson, chief technology officer for the computer firm Obsidian Security. 
 
 “Payment can occur and is usually tied to a specific demand,” he said. 
 
 CLOSE Use Uber? Your personal information might be at risk! In a public statement, Uber's CEO confirmed that information belonging to about 57 million customers and drivers was stolen by hackers. USA TODAY 
 
 That said, “paying off hackers to keep them quiet and avoid breach disclosure laws is pretty rare and another matter altogether,” he noted. 
 
 It’s also not a smart tactic, said Paul Lipman, CEO of antivirus company BullGuard. 
 
 " If you pay a hacker’s ransom, what guarantee do you have that they'll really delete your data? You can hardly rely on a cybercriminal to hold up their end of that bargain. Furthermore, it just serves to encourage further hacking, making all of us less secure.” 
 
 The New York State Office of the Attorney General has opened an investigation into the newly revealed breach, said press secretary Amy Spitalnick. 
 
 Khosrowshahi in his blog post said that "effective today, two of the individuals who led the response to this incident are no longer with the company." 
 
 Those individuals were chief security officer Joe Sullivan and fired Craig Clark, a senior lawyer who reported to Sullivan, Bloomberg said. 
 
 Uber did not respond to a request for comment for more details about the allegations. 
 
 In a statement to its users, Uber said it did not believe they needed to take action. "We have seen no evidence of fraud or misuse tied to the incident. We are monitoring the affected accounts and have flagged them for additional fraud protection," the statement read. 
 
 The breach began when attackers accessed Github.com, a website used by software engineers, and obtained login credentials there for information stored on an Amazon Web Services account controlled by Uber, Bloomberg said. In that account they found an archive containing rider and driver data. 
 
 That is similar to a 2014 case in which an Uber engineer put an access ID for Uber’s third-party cloud storage on Github.com, a website for software engineers. The post that was accessible to the general public, according to NY AG Schneiderman. In May, someone unaffiliated with Uber accessed the database, including Uber driver names and license numbers. 
 
 Uber discovered the breach in September 2014 but did not provide notice to the affected drivers or Schneiderman’s office until six months later, the Attorney General’s office said. 
 
 Uber agreed to pay a $20,000 penalty for failure to provide timely notice of the breach to drivers and the Attorney General. 
 
 More: Colorado hits Uber with $8.9 million fine over shady drivers 
 
 More: Uber admits its ghost driver 'Greyball' tool was used to thwart regulators, vows to stop 
 
 More: Uber says stolen self-driving car files never touched its servers 
 
 More: Victim in Uber India rape case may take action, her attorney says 
 
 Previous troubles 
 
 The fine comes as the ride-hailing company continues to be targeted by lawsuits for assault against its contractor drivers and struggles to polish a brand image tarnished by reports of systemic sexism and dodgy ethics that toppled cofounder and CEO Travis Kalanick earlier this year. He is still on Uber's board. 
 
 Uber had a history of playing fast and loose with regulators as it quickly grew from start-up to the dominant player in ride hailing. In Portland, Ore. it created and used a tool called “greyballing” in 2014 to thwart attempts by city regulators attempting to track the service. 
 
 Uber also came under fire during an investigation by Schniederman that it had created what was known as the "God view" to allow it to track riders and that it used the system at least once to track a reporter. 
 
 The company also fired executive Eric Alexander after press reports emerged that he had flown to India and illegally obtained the medical records of a woman who was raped by her Uber driver there, in an attempt to discredit her. 
 
 The former autonomous vehicle unit of Google, Waymo, has sued Uber, saying it hired former Google engineer Anthony Levandowski, who stole 14,000 files of trade secrets before leaving Google in January 2016. The suit alleges the files helped Uber improve its LiDAR technology. Uber has countered that the suit is just an attempt to stall a competitor in the potentially lucrative race for autonomous car tech. 
 
 Contributing: Marco della Cava 
 
 Follow Elizabeth Weise on Twitter @eweise 
 
 Read or Share this story: https://usat.ly/2B0rsEL
– The bad news: Uber suffered a major hack one year ago that exposed the accounts of 57 million customers and drivers. The worse news: The company decided to keep the breach a secret instead of informing victims, and it paid the hackers $100,000 to keep it under wraps, reports Bloomberg. Now the company, under new CEO Dara Khosrowshahi, is coming clean. “None of this should have happened, and I will not make excuses for it,” he said. “We are changing the way we do business.” Former CEO Travis Kalanick declined to comment. The company says the hackers got names, email addresses, phone numbers, and some drivers' license numbers, but no Social Security numbers or credit card information. Those affected will be notified. As both Bloomberg and the Wall Street Journal note, the size of the hack is relatively small when compared to breaches at, say, Yahoo and Equifax, but it's the attempt at a cover-up that makes the Uber case especially troubling. Uber says it discovered the breach in November 2016 and immediately took steps to shore up security. It did not, however, alert authorities or victims. Nor will it identify the hackers now. The company has fired security chief Joe Sullivan and a deputy for their roles in the breach and its aftermath, and New York Attorney General Eric Schneiderman has launched an investigation into the hack, reports USA Today.