Washington state has sued ride-sharing company Uber, saying it broke state law when it failed to notify more than 10,000 drivers that their personal information was accessed as part of a major data breach.
Uber says that the 2.7 million figure is an approximation because some users might disclose a different location to the one where they actually live.
The Article 29 Working Party, an advisory committee composed of data privacy watchdogs from each member state in the European Union, said after a meeting in Brussels that it had established a task force to coordinate national investigations into the breach that Uber says affected 57 million users worldwide. "Consumers expect and deserve protection from disclosure of their personal information".
The complaint alleges that "Uber executives were aware of the breach as early as November 2016", but nonetheless failed to provide notification until November 21, 2017-far exceeding the 45-day deadline. When a data breach puts people at risk, businesses must inform them, " Ferguson said in a news release.
Under current British law organisations which fail to disclose data breaches to regulators face a maximum fine of up to 500,000 pounds. With the announcement, San Francisco-based Uber said it concealed the breach for a year after paying $100,000 in ransom for the stolen information to be destroyed.
"Defendant's conduct is made more egregious by the fact that Uber paid the hackers to delete the personal information and keep quiet about the breach", Ferguson wrote in the lawsuit, filed in King County Superior Court.
Several states, including Missouri, Massachusetts and NY, have opened investigations, and the city of Chicago sued Uber on Tuesday for failing to notify affected residents.
Because Washington's data breach law does not define "personal information" as including names, email addresses, and telephone numbers, the complaint filed by Washington Attorney General Bob Ferguson relates only to the Uber drivers residing in Washington.
"We have seen no evidence of fraud or misuse tied to the incident", Uber said in a statement.