PA attorney general files lawsuit against Uber for waiting over 12 months to disclose the data breach from Oct 2016, which affected ~13,500 drivers in the state
Context & Ripple Effects
When Uber disclosed in late 2017 that it had paid a $100K ransom to cover up an October 2016 hack, the response came state by state: New York's attorney general opened an investigation into the $100,000 hack cover-up, Washington state sued over failure to notify roughly 10K users promptly, and Uber faced inquiries from five state AGs plus the FTC. Pennsylvania's suit adds a sixth legal front, focused specifically on the ~13,500 drivers whose data sat undisclosed for over a year.
What makes the Pennsylvania filing notable is who the plaintiffs are: drivers, not riders, deepening Uber's existing labor-adjacent litigation exposure. The arc these suits set in motion eventually converged — Iowa's attorney general announced Uber would pay $148M to settle claims from all 50 states over the same breach.
First-order effects
- Uber now defends a Pennsylvania-specific claim covering ~13,500 drivers on top of Washington state's suit and the New York investigation, multiplying discovery and settlement exposure across jurisdictions.
- Affected Pennsylvania drivers gain a state-backed enforcement vehicle, strengthening the parallel private class actions already filed against Uber over the breach.
Second-order effects
- Each new state suit raises the price of settling piecemeal, pushing Uber toward the consolidated multistate resolution that materialized as the $148M all-50-states deal rather than fighting dozens of individual AGs.
- Washington's template of seeking up to $2K per violation gives other AGs a ready-made damages model, lowering the cost for additional states to file their own disclosure-delay claims.
Third-order effects
- If the pattern holds, state attorneys general — not federal regulators alone — become the primary enforcement mechanism for breach-disclosure failures, with coordinated multistate settlements setting de facto national penalties.
- For companies holding driver and gig-worker data, the Uber sequence establishes that delayed disclosure carries compounding per-state liability, shifting the calculus toward faster notification even when the breach itself seems contained.
The trend: State attorneys general are consolidating into the dominant enforcement force for data-breach disclosure failures, converting individual state lawsuits into multistate settlements that function as national penalties.