Resolution Text
CID BN No. 17-036
IN RE: 2016 UBER DATA BREACH
x----------------------------------------------------x
For consideration of this Commission is the data breach notification dated 27 November 2017 of Uber Technologies, Inc.
Facts
Section 18 of Circular No. 16-03 provides when notification of data subjects should be done, thus:
“The data subjects shall be notified within seventy-two (72) hours upon knowledge of or reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred. The notification may be made on the basis of available information within the 72-hour period if the personal data breach is likely to give rise to a real risk to the rights and freedoms of data subjects. It shall be undertaken in a manner that would allow data subjects to take the necessary precautions or other measures to protect themselves against the possible effects of the breach. It may be supplemented with additional information at a later stage on the basis of further investigation.”1
On 14 November 2016, Uber was contacted by an individual who claimed he had accessed Uber user information.2 The company’s security team determined the unauthorized actor had obtained access to a private Uber developer page on GitHub, a third-party software development platform.3 Using credentials located there, the unauthorized actor was able to access and download certain archived driver and rider data stored in Amazon Web Services, a third-party cloud-based storage environment used by Uber.4 There was no breach of the Uber corporate systems or infrastructure.5
The security team quickly determined the means of access, shut down a compromised credential and took other steps intended to confirm that the actors had destroyed and would not use or further disseminate the information.6 Uber also implemented additional measures to improve its security posture, including instituting additional access controls for services used by engineers such as GitHub.7 The unauthorized actor’s access to this data began on 13 October 2016, and to the best of Uber’s knowledge, there was no further access by the actor to this data after 15 November 2016.8
On 20 November 2017, Uber B.V., through its CEO, DK, announced on the Uber website that there was a data breach involving parts of its user database that occurred sometime in 2016.9 DK announced that the data breach was discovered following a review, and that the persons involved in concealing the breach were no longer connected with Uber.10 DK also said that the perpetrators of the breach destroyed the exposed data after having received financial consideration therefor.11
At the time of the announcement, this Commission was made to understand that there were more than 50 million users and 7 million drivers across the world who were affected by the breach.12 We were also informed that what was exposed did not involve credit card information, and it did not involve trip histories.13
The compromised data was stored on Amazon Web Service Simple Storage Service (“S3”). S3 allows businesses to store large amounts of data in “buckets”, or directories.14 Access to this requires a login credential consisting of an authorized access key (“access key ID”) and a companion secret key.15
After the incident, Uber secured the services of Mandiant, an independent cybersecurity firm to review and assess what happened.16 Thereafter, a teleconference call was held so that this Commission may clarify its queries with Uber.17 During the call, Uber admitted that there was one Filipino whose Philippine driver’s license was exposed and that his number was initially among those considered as having been exposed in the United States.18 Uber then informed this Commission that the affected driver was notified of his exposure, and that steps were being taken to inform Filipinos of the breach.19 In addition, Uber also put up notices in the Help section of the Uber app and on the main Uber website.20 A dedicated Uber address [ ] was also indicated.21 Uber reported that only one in-app inquiry about the incident, and two e-mails to the dedicated address were received,22 but these were not related to the incident.23
Discussion
Since this incident occurred, Uber has constantly communicated and updated this Commission on the status of their investigation and the efforts they took to mitigate the impact of the breach. Considering that the data has not been found by the Commission’s investigators in the surface, deep, or dark web; that the employees responsible for the response to the incident have been let go; and that there were extensive measures to reach out to the public, the matter is one where the Commission determines that the further notification of affected data subjects is no longer required. Also, considering that there appears to be no immediate harm to the data subjects, no further action is recommended on this matter.
WHEREFORE, all premises considered, this Commission finds no further action necessary in this matter without prejudice to such other reliefs in case any new information arises.
SO ORDERED.
City of Pasay, Philippines 31 July 2019.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
IVY D. PATDU Deputy Privacy Commissioner
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
Copy furnished:
UBER TECHNOLOGIES, INC. Market Street San Francisco, California