Pennsylvania sues Uber over 2016 data breach

March 5 (UPI) -- Pennsylvania's attorney general sued Uber Monday over the way the ride-sharing company responded to a massive data breach nearly two years ago.

In a 13-page court document, Attorney General Josh Shapiro said the San Francisco-based company failed to notify users about the October 2016 breach -- and did not notify customers until more than a year later.

The breach exposed the names, email addresses and other information of Uber users around the world -- including the driver's license numbers of about 7 million drivers; 600,000 in the United States.

"Uber violated Pennsylvania law by failing to put our residents on timely notice of this massive data breach," Shapiro said in a statement. "Instead of notifying impacted consumers of the breach within a reasonable amount of time, Uber hid the incident for over a year - and actually paid the hackers to delete the data and stay quiet. That's just outrageous corporate misconduct, and I'm suing to hold them accountable and recover for Pennsylvanians."

The lawsuit alleges Uber violated the Pennsylvania Breach of Personal Information Notification Act, which requires notice to persons impacted by a data breach within a "reasonable" time frame. Penalties of up to $1,000 per violation can be sought.

With at least 13,500 Uber drivers in Pennsylvania impacted by the breach, authorities can try to put the company on the hook for as much as $13.5 million in the case.

"When it learned about the 2016 Data Breach, Uber did not notify law enforcement authorities or consumers about the breach," the lawsuit says. "Instead, Uber paid the hackers at least $100,000 to delete the acquired consumer data and keep quiet about the breach."

Several states, as well as officials in Great Britain, have opened investigations into the large-scale data breach issue.

"We've been in touch with several state attorney general offices and the [Federal Trade Commission] to discuss this issue, and we stand ready to cooperate with them going forward," Uber said last fall.