A Portland man who says his identity was stolen filed a lawsuit Wednesday against Uber, one day after the ride-sharing company confirmed it covered up a massive data breach for more than a year.
Medhi Seifian is seeking class-action status, according to the lawsuit filed in U.S. District Court in Portland. He says the cyberattack affected an estimated half-million Oregonians.
In October 2016, hackers stole the personal data of 57 million customers and drivers from Uber Technologies. Compromised data included names, email addresses and phone numbers of 50 million riders worldwide, the company told Bloomberg on Tuesday. The personal information of about 7 million drivers also was accessed, including some 600,000 U.S. driver’s license numbers.
Instead of promptly notifying consumers as required by state law, the suit says, the company paid hackers $100,000 to delete the data and keep the breach quiet.
Uber says it concealed massive cyberattack
Hackers have successfully infiltrated several companies in recent years, including Yahoo, Target and Equifax. But the Uber attack appears to involve cyber blackmail; that’s where hackers try to extort a big payment on the threat of selling stolen data to the highest bidder.
Uber told Bloomberg it believes the information stolen in 2016 was never used but declined to disclose the identities of the attackers.
Seifian, represented by Portland attorney Michael Fuller, says his identity was stolen after he started using the service in 2016. Since then, the suit says, he’s experienced undisclosed economic losses and his credit has suffered.
Uber could have mitigated those losses had it promptly notified customers of the cyberattack, the suit says. By the time it did, “the damage to their credit was already done.”
The suit seeks fair compensation to cover credit repair and monitoring services on behalf of “an estimated 500,000 Oregon consumers harmed by Uber’s failure to adequately protect their personal information.”
The company told Bloomberg it has seen “no evidence of fraud or misuse tied to the incident.” Uber said it will provide drivers whose licenses were compromised with free credit protection monitoring and identity theft protection.
–From staff and wire services