Uber’s announcement that it had been hacked in 2016 — resulting in the exposure of 57 million accounts — was shocking. Not because of the breach itself, but in the blunder its management made by paying a $100,000 ransom to the attackers and attempting to conceal the breach.
The breach itself
Under the hood
One of the unique attributes of Uber from the outset has been that payment for the ride occurs instantaneously and automatically at the end of a trip. This characteristic of the payment moving to the background has led to the invention of the term the “Uber-ization of payments” — meaning that the transaction is invisible.
But this is a one-way window. Everything that is invisible to the rider is collected and scrutinized by Uber or Lyft.
It has been no secret that Uber and Lyft have been attempting to build direct connections of their own between passengers and their payments. With this breach eroding trust in Uber’s brand, customers may seek third-party payment options within the Uber app that have a better reputation for security and integrity. This improves security for the consumer by tokenizing card data before it reaches Uber or Lyft, but the ride-sharing companies don't want this because it keeps them at arm's length.
“We don’t have a direct relationship at that point with that customer who’s signing on using Apple Pay,”
Increased scrutiny of Uber’s security and unethical responses may also cause something of a regulatory backlash. There has already been a warning shot from the U.K. that there will be implications.
“Deliberately concealing breaches from regulators and citizens could attract higher fines for companies,” James Dipple-Johnstone, deputy commissioner of the U.K. Information Commissioner’s Office, said in a statement. Current British law carries a maximum penalty of 500,000 pounds ($662,000) for failing to notify users and regulators when data breaches occur.
A long road ahead
It is entirely possible that in the current climate of data breach fatigue that consumers will just continue to use Uber as normal — memories are short and there is almost certainly another data breach around the corner to distract from the current one. However, Uber does not hold a monopoly on ride-sharing services, and the company has already come under fire for earlier practices such as
“I suspect that Uber customers won’t be switching to more secure forms of payment as much as they will be using Lyft instead,” said Al Pascual, Javelin’s research director. “Although the effects of a breach on customer choice aren’t long-lasting, they do avoid businesses where they have had information breached in a significant way for at least the first year after being notified. This isn’t anything close to a deathblow, to be certain, but there will be millions of customers over the coming weeks deleting the Uber app from their phones in response to the breach — the way it was handled will only incent more to do the same.”
