Uber facing a $13.5 million lawsuit over data breach

Uber is facing another lawsuit over the massive 2016 data breach. This time, it’s from

Pennsylvania Attorney General Josh Shapiro, who alleges Uber violated the state’s data breach notification law.

Shapiro specifically alleges Uber violated the Pennsylvania Breach of Personal Information Notification Act, which requires companies to notify people impacted by a data breach within a reasonable amount of time. That specific law enables the Attorney General’s office to seek up to $1,000 for each violation.

In Pennsylvania, Shapiro says at least 13,500 Uber drivers were affected. That means Shapiro can seek up to $13.5 million from Uber.

As previously reported, Uber did not notify the attorney general’s office until November 21, 2017, more than a year after Uber first discovered the breach. And before Uber reported the breach, the company paid off hackers to destroy the data.

“Uber violated Pennsylvania law by failing to put our residents on timely notice of this massive data breach,” Shapiro said in a press release. “Instead of notifying impacted consumers of the breach within a reasonable amount of time, Uber hid the incident for over a year – and actually paid the hackers to delete the data and stay quiet. That’s just outrageous corporate misconduct, and I’m suing to hold them accountable and recover for Pennsylvanians.”

In total, the breach affected some 57 million riders and drivers. That affected group included 50 million riders and 7 million drivers, and about 600,000 driver license numbers were included in the breach.

This is not the first lawsuit Uber is facing over the data breach. In November, Washington State Attorney General Bob Ferguson filed a multimillion-dollar consumer protection lawsuit against the transportation company.

Ferguson’s lawsuit sought penalties for up to $2,000 per violation, alleges Uber violated Washington’s data breach law by failing to notify those affected, as well as the attorney general’s office, within an appropriate amount of time.

That same month, Chicago and Cook County’s state attorney sued Uber over the data breach.