Uber says 2.7 million in UK were affected by security breach

Uber has admitted that 2.7 million people in the UK were affected by a 2016 security breach that compromised customers’ information, including names, email addresses and mobile phone numbers.

The ride-hailing company had previously disclosed that 57 million people worldwide were affected by a breach that it covered up for more than a year.

It published an estimate of the number of UK drivers and passengers for the first time, prompting concern from the mayor of London, where Uber is already battling a decision to revoke its licence to operate.

“This latest shocking development about Uber will alarm millions of Londoners whose personal data could have been stolen by criminals,” Sadiq Khan said.

“Uber needs to urgently confirm which of their customers are affected, what is being done to ensure these customers don’t suffer adversely, and what action is being taken to prevent this happening again in the future.

“The public will want to know how there could be this catastrophic breach of personal data security.”

The data regulator, the Information Commissioner’s Office (ICO), said it was yet to receive technical reports on the incident and called on Uber to alert affected customers as soon as possible.

Uber said the figure of 2.7 million, more than half of its 5 million UK customer base, was an “approximation rather than an accurate and definitive count” because it could not always tell where each customer was located.

In a statement buried in the “Help” section of its website, it added that experts hired to investigate the data breach did not believe customers’ financial details were leaked.

“Our outside forensics experts have not seen any indication that trip location history, credit card numbers, bank account numbers or dates of birth were downloaded,” the company said.

“When this happened, we took immediate steps to secure the data, shut down further unauthorised access, and strengthen our data security.”

The ICO deputy commissioner, James Dipple-Johnstone, said: “On its own this information is unlikely to pose a direct threat to citizens.

“However, its use may make other scams, such as bogus emails or calls appear more credible. People should continue to be vigilant and follow the advice from the National Cyber Security Centre (NCSC).

“As part of our investigation we are still waiting for technical reports which should give full confirmation of the figures and the type of personal data that has been compromised.

“We are continuing to work with the NCSC plus other relevant authorities in the UK and overseas to ensure the data protection interests of UK citizens are upheld.”

Alex Neill of consumer group Which? said: “Data breaches are becoming more and more common and yet the protections for consumers are lagging behind.

“The UK government should use the data protection bill to give independent bodies the power to seek collective redress on behalf of affected customers when a company has failed to take sufficient action following a data breach.”

Details about the extent to which Uber’s breach affected UK citizens, as well as revelations that it kept quiet about it for a year, add to a growing list of problems for its new chief executive, Dara Khosrowshahi.

In the UK, the company is battling to overturn a decision by Transport for London to revoke its licence, amid concerns about the reporting of crime and background checks on drivers.

The San Francisco-based firm is also due to apply to the supreme court to overturn a ruling that its drivers should be classed as “workers” with improved employment rights.