Uber Drivers’ Personal Data Stolen in Third-Party Breach

Uber says some of its drivers’ personal data might have been stolen in a third-party breach. Its outside legal counsel, Genova Burns LLC, suffered a security incident in March. Drivers’ social security numbers and/or tax identification numbers could be among the files taken.

Affected drivers who completed trips in New Jersey have been told that their social security number and/or tax identification number could be exposed. Uber is offering them free credit monitoring and identity protection.

Genova Burns has said it is not aware of any actual or attempted misuse of the information. The firm says it is taking extra steps to improve its security and prevent a repeat.

The incident shows how much risk sits with third parties. Uber says its own systems were not affected. Its drivers’ data still ended up exposed, through a law firm, which is exactly why companies need to check the security practices of every vendor and adviser that holds their data, not just their own.

If you were affected, protect yourself. Change your passwords, turn on two-factor authentication and watch your bank and credit card statements for anything odd. Be wary of emails asking for private details.

Every company that handles personal data should review its security practices after an incident like this, including those of its outside firms. Uber has responded. Affected drivers should still keep a close eye on their credit reports for months.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.