HackingTechnologyTransportation & LogisticsInformationStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDCriticalContained

UBER TECHNOLOGIES, INC.

bd_cb676ca7c713e68b · schema v1 · pii pii-v1

Severity

Critical

Discovered

Nov 15, 2016

Filed

Nov 21, 2017

To disclose

12 months

Affected · nationwide

600,00010,888 in this filing

Linked

6 filings

Confidence

69%

Full breach record for UBER TECHNOLOGIES, INC. →10 incidents on file

Uber Technologies, Inc. reported a 2016 cyberattack where unauthorized actors accessed Uber's AWS environment using compromised credentials. The incident exposed names and driver's license numbers of approximately 600,000 US drivers, including 10,888 in Washington. Access occurred from Oct 13 to Nov 15, 2016. Uber discovered the breach on Nov 15, 2016, but delayed notification until Nov 22, 2017, offering credit monitoring to affected drivers.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 33 days

discovery → filing · 12 months / 371 days

Oct 13, 2016

Begins

Nov 15, 2016

Discovered

Nov 21, 2017

Filed

vs. sector median

+35 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_5aac63ae95779a492017-11-21Verified
Montana State AGbd_74ccb250c0dca8c32017-11-21Verified
Oregon State AGbd_8cb0530a7d7281d12017-11-21Candidate
California State AGbd_dfe6822f4d0881262017-11-21Verified

Show 1 more filing ↓up to 7d gap

Massachusetts State AGbd_103b55f80b2fd5c62017-11-28 · +7dVerified

Name: Perkins Coie LLP
norm: perkins coie
Domain: perkinscoie.com

Name: UBER TECHNOLOGIES, INC.
norm: uber technologies
Industry: TechnologyllmTransportation & Logisticsllm

Discovered: Nov 15, 2016
Breach occurred: Oct 13, 2016 – Nov 15, 2016
Undetected for: 33 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 22, 2017
Affected individuals: 600,000state + nationwide
Data types: Identity (basic)Government ID
Data elements: NameDriver's licence number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the Washington Attorney General
Initial access: valid_credentials

During the incident: Shut down a compromised credential
Took other steps intended to confirm that the actors had destroyed and would not use or further disseminate the information
Implemented additional measures to improve its security posture
Providing notice to the individuals whose driver’s license information was downloaded in this incident
Offering 12 months of credit monitoring and identity theft protection services to these individuals free of charge
Taking personnel actions with respect to some of those involved in the handling of the incident
Implemented and will implement further technical security measures, including improvements related to both access controls and encryption
Changes made: Implemented further technical security measures, including improvements related to both access controls and encryption
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 months(371 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

New Hampshire State AGNov 21 · first

Montana State AGNov 21 · first

Oregon State AGNov 21 · first

California State AGNov 21 · first

Washington State AGNov 21 · first · this page

Massachusetts State AG+7d

Pattern: first filing Nov 21 (NH), last Nov 28 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9752.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 21, 2017
Raw hash: d253ca46c84d170ac7db0a51a1ffbb7045132a2d09683d32e125b2ee73f9842b

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityPerkins Coie LLP

Victim entityUBER TECHNOLOGIES, INC.

Incidentdiscovered Nov 15, 2016

Stated responseShut down a compromised credential

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com