Uber concealed a massive global breach of the personal information of 57 million customers and drivers in October 2016, failing to notify the individuals and regulators, the company acknowledged on Tuesday. The company said more sensitive information, such as location data, credit card numbers, bank account numbers, social security numbers, and birth dates, had not been compromised. “The only way one can have direct liability under security breach notification statutes is to not give notice. Photograph: Bloomberg/Bloomberg via Getty ImagesThe New York state attorney general’s office has opened an investigation into the data breach, a spokeswoman confirmed. Uber’s potential civil liability from the breach is complicated by the fact that the United States’ various federal appellate courts are divided over how to treat data breach lawsuits.

Source: The Guardian November 21, 2017 22:53 UTC