Hackers have stolen the personal data of 57 million Uber customers and drivers. The company paid the hackers $100,000 to delete the data and stay quiet for over the course of a year.
The data breach included names, email addresses, and phone numbers of about 50 million Uber riders and the personal information of 7 million drivers.
It also included 600,000 license numbers, but no social security numbers and no details about rides. And there have been no signs of frauds.
The data breach was discovered in November 2017 via an investigation conducted by an outside law firm into Uber's security team. The cause of the breach was Uber engineers in leaving their AWS keys on GitHub.
Travis Kalanick learned of the breach in November 2016, a month after the breach happened. At the time, the company was negotiating with the U.S. Federal Trade Commission over the handling of consumer data.
"None of this should have happened, and I will not make excuses for it," said CEO of Uber Khosrowshahi who replaced Kalanick. "We are changing the way we do business.”
In response after the revelation, Uber fired Chief Security Officer Joe Sullivan. He was one of the few remaining executives from the Kalanick era. Senior lawyer Craig Clark was also fired.
As part of Khosrowshahi's effort to secure Uber better legally, the company hired Matt Olsen, a former general counsel at the NSA and director of the National Counterterrorism Center, as an adviser.
