"You may be asking why we are just talking about this now, a year later," wrote Khosrowshahi in a blog post. "I had the same question, so I immediately asked for a thorough investigation of what happened and how we handled it."
[Ads /]
According to KGO-TV, Khosrowshahi explained that the incident happened in late 2016 and involved two hackers accessing data on a third party cloud-based service. He said that Uber's corporate systems were not impacted, but the hackers also got the names and license numbers of around 600,000 drivers in the United States in addition to riders data.
Uber claims its forensics experts determined that no trip location history, credit card numbers, bank account numbers, social security numbers or of dates of birth were downloaded. They also claim that they were able to identify the hackers and get guarantees that the downloaded data was destroyed.
Bloomberg news reports that the company paid the hackers $100,000 to delete the data and keep the breach quiet. They also report that Uber's chief security officer Joe Sullivan and one of his deputies were ousted earlier this week.
Uber confirmed that two people who led the response to this incident are no longer with the company.
"As Uber's CEO, it's my job to set our course for the future, which begins with building a company that every Uber employee, partner and customer can be proud of," wrote Khosrowshahi. "For that to happen, we have to be honest and transparent as we work to repair our past mistakes."
Uber said it is notifying regulatory authorities and offering free credit and identity theft monitoring for drivers.
[Ads /]
"None of this should have happened, and I will not make excuses for it," Khosrowshahi wrote. "While I can't erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes. We are changing the way we do business."
This is not the first time that Uber's data has been breached. In 2014 the data of 50,000 Uber drivers was compromised in another hack. Attorneys for Uber pointed the finger at rival Lyft but the identity of the hacker was never determined.
Drivers affected in that breach filed a lawsuit against Uber in that case.
More information for Uber users
More information for Uber Drivers
----------
Send a breaking news alert
Report a correction or typo
Learn more about the 6abc apps