Uber agrees to $148M settlement with Mass., other states over data breach

BOSTON, Mass. — Uber has agreed to pay $148 million and take steps to tighten data security, after allegations the ride-hailing company failed for a year to notify drivers that hackers had stolen their personal information.

The settlement involves all 50 states and the District of Columbia and Uber Technologies Inc.

“Uber failed to immediately report this data breach and tried to pay hush money to hackers,” said Massachusetts Attorney General Maura Healey. “This settlement should be a lesson to other businesses that consumers have a right to know when their personal information has been compromised.”

According to the complaint, Uber learned in November 2016 that hackers had accessed its internal databases and acquired the names, email addresses and mobile phone numbers of 57 million Uber riders and drivers, as well as the names and drivers’ license numbers of 600,000 U.S.-based drivers.

The company acknowledged the breach in November 2017, saying it paid $100,000 in ransom for the stolen information to be destroyed.

Under the terms of the settlement, Massachusetts will receive approximately $7.1 million.

The Associated Press contributed to this article.

Cox Media Group