HackingTechnologyInformationStolen CredentialsDelayed DiscoveryData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDCriticalContained

UBER TECHNOLOGIES, INC.

bd_5aac63ae95779a49 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Nov 15, 2016

Filed

Nov 21, 2017

To disclose

12 months

Affected

600,000

Linked

6 filings

Confidence

66%

Full breach record for UBER TECHNOLOGIES, INC. →10 incidents on file

Uber Technologies, Inc. notified the NH AG of a 2016 data breach where unauthorized actors accessed Uber's AWS environment using compromised credentials. The incident affected approximately 600,000 US drivers, exposing names and driver's license numbers. Access occurred Oct 13-Nov 15, 2016. Uber discovered the breach in Nov 2016 but delayed notification until Nov 2017, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 33 days

discovery → filing · 12 months / 371 days

Oct 13, 2016

Begins

Nov 15, 2016

Discovered

Nov 21, 2017

Filed

vs. sector median

+35 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_74ccb250c0dca8c32017-11-21Verified
Oregon State AGbd_8cb0530a7d7281d12017-11-21Candidate
Washington State AGbd_cb676ca7c713e68b2017-11-21Verified
California State AGbd_dfe6822f4d0881262017-11-21Verified

Show 1 more filing ↓up to 7d gap

Massachusetts State AGbd_103b55f80b2fd5c62017-11-28 · +7dVerified

Name: UBER TECHNOLOGIES, INC.
norm: uber technologies

Name: UBER TECHNOLOGIES, INC.
norm: uber technologies
Industry: Technologyllm

Discovered: Nov 15, 2016
Breach occurred: Oct 13, 2016 – Nov 15, 2016
Undetected for: 33 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 22, 2017
Affected individuals: 600,000nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Shut down a compromised credential
Took other steps intended to confirm that the actors had destroyed and would not use or further disseminate the information
Implemented additional measures to improve its security posture
Providing notice to the individuals whose driver's license information was downloaded
Offering 12 months of credit monitoring and identity theft protection services
Taking personnel actions with respect to some of those involved in the handling of the incident
Implemented and will implement further technical security measures, including improvements related to both access controls and encryption
Changes made: Made changes to its data storage environment and security procedures
Implemented further technical security measures, including improvements related to both access controls and encryption
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 months(371 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGNov 21 · first

Oregon State AGNov 21 · first

Washington State AGNov 21 · first

California State AGNov 21 · first

New Hampshire State AGNov 21 · first · this page

Massachusetts State AG+7d

Pattern: first filing Nov 21 (MT), last Nov 28 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/uber-technologies-20171121.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 21, 2017
Raw hash: 75655b18167f724a5dbaa79c9f4cc84eda148d7ca46ae7fc6bfd9fb63ac2cdad

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityUBER TECHNOLOGIES, INC.

Victim entityUBER TECHNOLOGIES, INC.

Incidentdiscovered Nov 15, 2016

Stated responseShut down a compromised credential

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov