Earlier today it was reported that around 2.7 million British customers and drivers were affected by a 2016 data breach, which was covered up until last week. It means the majority of Uber users in the UK were affected by the hack, which saw names, email addresses and phone numbers stolen. IT security experts commented below.
Christopher Day, Chief Cyber Security Officer at Cyxtera:
“Paying criminals to delete stolen data and failing to notify victims is disturbing on multiple levels. At a minimum, it flies in the face of ethics and transparency. It emboldens attackers and keeps the cybersecurity community from understanding techniques that could help other organizations prevent a similar attack. From a legal perspective, Uber failed to properly notify victims. This will inevitably cost the company dearly in terms of penalties and lawsuits. In fact, UK regulators are digging in already to understand the scope; which could trigger GDPR-related fines. The New York State Attorney General’s office is also investigating the event.
“From what we know, attackers accessed GitHub, a code repository hosting service used by Uber developers. They obtained login credentials and hacked into a server storing data about Uber riders and drivers. This is a fairly ‘vanilla’ attack in terms of its sophistication. It could have been prevented by locking down access using an approach like a software-defined perimeter (SDP). Essentially, SDP isolates the user from accessing resources they aren’t entitled to see by leveraging multiple factors. It takes into consideration what the user is trying to do at the time they’re trying to do it. For example, in this case, the system could have required the hackers to present a one-time password before granting access to the server.”
Adam Brown, Manager – Security Solutions at Synopsys:
“Reports today have shown that 2.7million of the 57million data subjects in the Uber breach were citizens of the European Union, so Uber as the data controller had a duty to notify each one of them within 72 hours after becoming aware in accordance with article 33 of the GDPR. It appears the details were lost from a cloud platform. However as the data processor the cloud platform would be liable to certain technical requirements, the data controller, Uber, owns the responsibility. The GDPR was law when this breach happened but is not enforceable until May next year, had Uber made the admission after May the 25th, the GDPR administrative fines could have been huge. Consideration can be taken into account regarding the situation according to article 83, however in this case due to the cover up, I would have expected expect fines at full bore.”
Amit Yoran, CEO at Tenable:
“The Uber hack is just the latest example of a widespread culture of lackadaisical cyber practices and a lack of executive accountability — this mischaracterizes corporate risk and cripple cybersecurity efforts. Executives and organizations must be held accountable for both exercising a reasonable standard of care to protect their systems and their data and for discovering and disclosing breaches in a timely manner.”
.
Tim Erlin, VP of Product Management and Strategy at Tripwire:
“There’s already a lot to learn about this breach and how it was handled, but as with every breach, we’re likely to learn more as the incident receives more scrutiny. Some of that scrutiny is now coming from the New York Attorney General. Sometimes the wheels of the law move slowly, but they tend to have more stamina than the headlines.
“We’ve seen an growing pattern with executive impact from cybersecurity breaches, and while it may seem more than warranted in this case, the pattern is continuing with Uber and its Chief Security Officer. A cover-up like this can’t help but drive the question of what other breaches are known, but kept quiet. It can’t help but damage consumer confidence, not just in Uber, but in any company collecting personal data. Consumers now have to worry about undisclosed breaches in addition to undiscovered breaches.”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.