Uber says 2016 data breach hit 2.7m UK users, or most of its base

People walk down a taxi lane during a strike by taxi drivers to protest what they say is unfair competition from new car sharing companies such as Uber and Cabify, in Madrid, Spain, November 29, 2017. REUTERS/Sergio Perez

Uber Technologies Inc. has informed Britain’s data protection regulator that about 2.7 million user accounts — representing the vast majority of people using the ride-hailing service in the country — were affected by a 2016 data breach.
The breach, which the company disclosed last week involving 57 million users worldwide, saw names, mobile phone numbers and email addresses compromised, the company told UK’s Information Commissioner’s Office (ICO).
ICO said it expects Uber to alert all the affected British users, both Uber drivers and passengers, as soon as possible.
The breach was a further setback to the Silicon Valley company after London’s transport regulator stripped it of its operating license in September, citing Uber’s approach to reporting serious criminal offenses and background checks on drivers.
Uber failed to disclose the massive breach at the time, the company’s new chief executive officer said last week.
Under current British law organizations which fail to disclose data breaches to regulators face a maximum fine of up to 500,000 pounds ($670,600).
In Britain, Uber drew around 2.85 million users, on average, over the past three months, according to web and mobile app traffic measurement firm SimilarWeb, indicating that most British Uber users were likely caught up in the breach.
Uber said on its website on Wednesday that independent forensics experts had not seen any indication that trip location history, credit card numbers, bank account numbers or dates of birth were downloaded in the breach.
“We do not believe any individual rider needs to take any action,” the company said.
“We have seen no evidence of fraud or misuse tied to the incident. We are monitoring the affected accounts and have flagged them for additional fraud protection.”
Uber has been forced to quit several countries, including Denmark and Hungary, and faced regulatory battles in multiple US states and around the world.
It comes after a tumultuous few months for the San Francisco start-up that led to former CEO and co-founder Travis Kalanick being forced out after a series of boardroom controversies.