Uber Technologies has agreed to pay a $148 million penalty to all 50 states in the U.S. and the District of Columbia for covering up a data breach that impacted millions of drivers and customers, law enforcement officials said Wednesday.
California Attorney General Xavier Becerra and District Attorney George Gascon announced the nationwide settlement with Uber following an investigation into the conduct of the San Francisco-based company in response to the data breach.
The officials said Uber paid off the hackers involved in exposing the information of 57 million users in 2016 instead of reporting the breach, which was later uncovered by an internal review by Uber’s Board of Directors.
“They were lying to their customers in terms of their security precautions, they were lying to their drivers,” Gascon said at a press conference. “They were basically violating every rule in the book.”
Becerra said Uber broke several laws when it failed to inform users.
“The innovators must remember that protecting the privacy of the customer isn’t just the right thing to do, in California it’s the law,” Becerra told reporters.
As well as monetary penalties, Becerra said Uber has also agreed to “integrate privacy considerations into every phase of its products development.”
The San Francisco District Attorney’s Office and California Office of the Attorney General will split a $26 million of the settlement.