Uber Paid Hackers to Delete Stolen Data on 57M People • Hacker News Board

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#51

Post by theDoug » Tue, Nov 21, 2017, 10:43 PM UTC

vthallam wrote: post #24

> Uber said it will provide drivers whose licenses were compromised with free credit protection monitoring and identity theft protection This got to be a running joke now. Companies lose the data and offer credit/theft protection than facing the consequences. If Equifax could get away with the giant breach, I am sure Uber will not even feel the heat. smh.

I moved to the US in April was and shocked by the Equifax breach, but more surprised to hear from a coworker how often these “free credit/identity monitoring for a year” situations occur.

One co-worker is covered by no less than four groups who failed to look out for him earlier, all for trusting companies to not screw up PII or remember that data is a liability.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#52

Post by dajohnson89 » Tue, Nov 21, 2017, 10:44 PM UTC

jtchang wrote: post #10

"In January 2016, the New York attorney general fined Uber $20,000 for failing to promptly disclose an earlier data breach in 2014." Because you know...20k really really hurts for a company like Uber.

more than 100% of their profits?

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#53

Post by lanius » Tue, Nov 21, 2017, 10:45 PM UTC

untog wrote: post #40

jtchang wrote: post #10

"In January 2016, the New York attorney general fined Uber $20,000 for failing to promptly disclose an earlier data breach in 2014." Because you know...20k really really hurts for a company like Uber.

I recall a story (that I'll probably recount incorrectly) about a daycare business deciding that too many parents were arriving late to pick up their children (meaning that staff had to stay late with the kids), so they instituted a fine for late pickups. The result was that more parents were late. The reason being that the parents effectively considered the fine a "late pickup fee", and one they were more than willi…

Here's an article about that: http://www.nytimes.com/2005/05/15/books/chapters/freakonomic...

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#54

Post by bogomipz » Tue, Nov 21, 2017, 10:47 PM UTC

The CSO was able to arrange for $100K to be paid out without any oversight of what that money was for?

If it was paid to hackers it's unlikely that finance cut a check. I'm imagining this was paid in bitcoin or similar. How was this able to be approved?

I'm guessing someone created a fake invoice? Wouldn't that constitute fraud?

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#55

Post by michaelbuckbee » Tue, Nov 21, 2017, 10:48 PM UTC

IANAL but I did some basic visualization work as part of a story on US state data breach regulations. What may be Uber's undoing is that they must have the drivers license numbers for all of their drivers on file and that is considered PII by 45 states (nevermind that they also missed their reporting deadline).

And if you're interested, a gif of the data:

https://imgur.com/Rm32MeC

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#56

Post by asabjorn » Tue, Nov 21, 2017, 10:49 PM UTC

madamelic wrote: post #47

Yep. About that time my Uber account was 'hacked' and someone kept requesting rides in Florida and I had to cancel them as fast as they made them. I emailed Uber support and they got back to my 3 days later. Then someone proceeded to try to gain access to every account I had with that email and password (yeah, yeah, I know). The next worse was someone getting into my DigitalOcean account and launching an instance. It…

In the disclosure it says that the attack included names, email addresses and phone numbers. It did not contain any passwords or social security numbers, so your passwords must have been compromised in some other way.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#57

Post by ejcx » Tue, Nov 21, 2017, 10:49 PM UTC

I can not believe Joe Sullivan would just sit there during this. There has to be so much more to this story.

I can not imagine he would be on board with negotiating with the hacker, and cannot imagine him sitting idly for a year after the cover up.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#58

Post by untog » Tue, Nov 21, 2017, 10:49 PM UTC

Swizec wrote: post #49

untog wrote: post #40

Earlier quoted context omitted.

I recall a story (that I'll probably recount incorrectly) about a daycare business deciding that too many parents were arriving late to pick up their children (meaning that staff had to stay late with the kids), so they instituted a fine for late pickups. The result was that more parents were late. The reason being that the parents effectively considered the fine a "late pickup fee", and one they were more than willi…

> The reason being that the parents effectively considered the fine a "late pickup fee", and one they were more than willing to pay. The real question in this story is this: If you find that you have customers who are willing to pay you more for providing more service ... why not provide that service? You get more money, your staff gets paid overtime, parents get peace of mind, everyone's happy.

I... don't really think that's the point of the story. Certainly not in any way that involves keeping this conversation on the topic of Uber being fined.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#59

Post by tedunangst » Tue, Nov 21, 2017, 10:49 PM UTC

gr3yh47 wrote: post #46

untog wrote: post #40

Earlier quoted context omitted.

I recall a story (that I'll probably recount incorrectly) about a daycare business deciding that too many parents were arriving late to pick up their children (meaning that staff had to stay late with the kids), so they instituted a fine for late pickups. The result was that more parents were late. The reason being that the parents effectively considered the fine a "late pickup fee", and one they were more than willi…

>Just pay the toll especially when the cost of doing the right thing is higher. i mean look at HSBC - laundered trillions of dollars of mega-organized-crime money. for a decade. 400m dollar fine probably isnt even .01% of what they made off that endeavor

If HSBC was making profits of $4 trillion, they were also lying on their financial statements.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#60

Post by _m8fo » Tue, Nov 21, 2017, 10:50 PM UTC

stevenj wrote: post #4

Ever since Susan Fowler told her story about what happened to her at Uber, I have only used Lyft, and have encouraged all my friends to do the same. I plan to never use Uber again.

You'll find that thinking like that will only lead to misery at worst and hypocrisy at best. For example, if you live in the United States (though this logic applies to any country, really), you'll be interested to know that the US holds the world record for the amount innocent civilians killed [1].

[1] https://www.globalresearch.ca/u-s-holds-the-world-record-of-...

EDIT: I realize I sound far more judge-y than intended in these posts. My overall point is that people should just do whatever makes 'em happy while doing the best you can (w.r.t. everything else). Trying to emphasize the morality in your actions is just wrong, imo.