HackingTechnologyInformationStolen CredentialsDelayed DiscoveryCustomer Data InvolvedIdentity (basic)Government IDMediumResolved

UBER TECHNOLOGIES, INC.

bd_7d2eb1fa183e80d0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 1, 2014

Filed

Jun 15, 2016

To disclose

22 months

Affected

1state residents only

Linked

2 filings

Confidence

64%

Full breach record for UBER TECHNOLOGIES, INC. →10 incidents on file

Uber notified Montana residents of a 2014 data breach where an unauthorized third party accessed a database containing driver names and driver's license numbers. The breach occurred on May 13, 2014, but was discovered in September 2014. Notification was sent in June 2016, offering one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 111 days

discovery → filing · 22 months / 653 days

May 13, 2014

Begins

Sep 1, 2014

Discovered

Jun 15, 2016

Filed

vs. sector median

+75 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Washington State AGbd_1f04f03457eb1dbe2016-06-16 · +1dVerified

Name: UBER TECHNOLOGIES, INC.
norm: uber technologies

Name: UBER TECHNOLOGIES, INC.
norm: uber technologies
Industry: Technologyllm

Discovered: Sep 1, 2014
Breach occurred: May 13, 2014
Undetected for: 111 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 15, 2016
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Ensured that the database was no longer accessible using that information
Taken additional safety measures to protect your information
Continued to investigate the incident
Offering a complimentary one-year enrollment in My TransUnion Monitoring
Changes made: Restricted access to the database
Taken additional safety measures to protect your information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 months(653 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGJun 15 · first · this page

Washington State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Uber.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 15, 2016
Raw hash: 0e28883c1b74d91a6257376843c862667a5098800eb9bc88203bfb5adaed16f3

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityUBER TECHNOLOGIES, INC.

Victim entityUBER TECHNOLOGIES, INC.

Incidentdiscovered Sep 1, 2014

Stated responseEnsured that the database was no longer accessible using that information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov