New York attorney general launches investigation of Uber's $100,000 hack cover-up
The revelation that Uber concealed a major 2016 data breach affecting 57 million users and paid hackers to destroy the evidence is yet another PR nightmare from Uber's darkest era, but it's also a major problem …
Context & Ripple Effects
Days after Uber fired its chief security officer and disclosed that hackers stole data on 50 million riders and 7 million drivers in October 2016 — including 600,000 driver's license numbers — and that Uber paid them $100,000 to delete it (the disclosure that cost the CSO his job), New York's attorney general has opened a formal investigation into the cover-up itself.
The probe lands on top of an already crowded docket: Uber is facing investigations from five US state AGs, at least three potential class actions, and FTC contact over the same breach (the multi-state investigation wave). The legal exposure is long-lived — in 2022 Uber admitted as part of a settlement that it failed to inform the FTC of the breach at all (the criminal-charge-avoiding settlement).
First-order effects
- Uber now faces a formal New York AG investigation specifically targeting the concealment and the $100,000 payment to destroy evidence, adding to the five state AG probes, three potential class actions, and FTC scrutiny already aimed at the company.
Second-order effects
- The disclosure forces regulators and courts to decide how to treat the payment itself: the fallout exposes legal ambiguity over whether paying a hacker who stole consumer data is extortion, ransom, or a bug bounty gone wrong (the bug-bounty ambiguity question).
Third-order effects
- If the pattern holds, breach concealment becomes a distinct liability separate from the breach — companies that delay disclosure face investigations and settlements for the cover-up even years later, pushing security teams toward faster, more conservative disclosure practices.
The trend: Data-breach accountability is shifting from punishing the hack to punishing the concealment, with state AGs and the FTC treating delayed disclosure as its own offense.