Uber has admitted to concealing a massive global breach of customer personal information back in October 2016.
The car-hailing app said they paid the hackers $100 million to delete the information of 57 million customers and drivers and keep the data breach under wraps.
Chief executive Dara Khosrowshahi said in a statement: “None of this should have happened, and I will not make excuses for it. While I can’t erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes.
“We are changing the way we do business, putting integrity at the core of every decision we make and working hard to earn the trust of our customers.”
Uber confirmed that hackers stole the names, email addresses and phone numbers of 600,000 customers and drivers but more sensitive information such as location data, credit card numbers, bank account numbers and social security numbers had not been stolen.
Under many laws, companies must notify residents of any breach of unencrypted personal information. They must also inform the attorney general if more than 500 residents are affected by a single breach.
Uber has already been fined $20,000 for a less serious breach in January this year.
“At the time of the incident, we took immediate steps to secure the data and shut down further unauthorized access by the individuals,” said the chief executive in his statement.
“We subsequently identified the individuals and obtained assurances that the downloaded data had been destroyed. We also implemented security measures to restrict access to and strengthen controls on our cloud-based storage accounts.”
“On behalf of everyone at Uber globally, I apologise for the mistakes we’ve made.”
In a separate statement to drivers, the controversial company said it planned to offer those affected free credit monitoring and identity theft protection.
Since Bloomberg reported the news, Uber’s chief security officer Joe Sullivan has resigned from the company.