Uber's 2016 breach is remembered not just for exposed data, but for the company's handling of the incident after discovery. The breach affected 57 million users and drivers, exposing names, email addresses, and phone numbers.
The Discovery
Two hackers gained access to Uber's GitHub account, which contained credentials for an Amazon Web Services server storing user data. Instead of reporting the breach, Uber's leadership chose to pay the hackers $100,000 to delete the data and keep the incident quiet.
The Fallout
When the breach was finally disclosed a year later, the consequences were severe. Uber's CEO was forced to resign, the company faced investigations from multiple regulators, and the trust of users was severely damaged. The incident became a textbook example of how not to handle a data breach.
Key Lessons
- Transparency is essential when handling security incidents
- Bug bounty programs should be separate from incident response
- Credentials should never be stored in code repositories
- Regulatory reporting requirements must be followed
Impact: 57 million users affected, $148 million settlement, executive resignations.