Round 2: New line-up of cybersecurity maestros comment on Uber breach

Following the news of the massive Uber breach that the company kept under wraps for more than a year, we covered a story that provided commentary from various experts. Now we have round two, with cybersecurity authorities from Check Point, Digital Shadows, Barracuda Technologies, Mimecast, and Webroot.

"Companies holding individuals' personally identifiable information, financial details, and other sensitive data have an obligation to keep that information safe. When customers provide such information during transactions with various businesses they implicitly trust that the details will be stored, used and processed in a secure manner.

Any such breach should be immediately made known as it directly affects the security of each user's personal details. The mandatory disclosure laws being implemented in Australia this coming February will be of great assistance in allowing users to be informed of breaches impacting the confidentiality of their information. Unfortunately, not all countries have such laws, although many are phasing them in over the short to mid-term.

In light of this, it is still wise advice to only provide the personal details absolutely required by the services used, and to ensure different passwords are configured for each service an individual subscribes to."

"While you could be surprised at such an effective architect of the digital world would not be fully prepared for such an event, it does show that even the most tech savvy businesses are open to the menace of data breaches and cyberattacks.

But what is absolutely certain is that this sort of attack should have been spotted sooner and ideally before significant data had been extracted. If basic login details were stolen, this is something Uber could have been monitoring for and prevented. The storage of sensitive IT system logins should not have been in that website in the first place.

What is most concerning about this incident is the steps taken by Uber to notify people about the issue and describe what they have done to deal with it. A long period has elapsed since they were aware. Again, we don't know the full details from Uber, but it is beholden on all businesses who have suffered a data breach to notify their staff, customers, suppliers and in some cases the regulator their data might be exposed, and it doesn't seem like this happened until now some months after the event."

 "Uber had both the legal and social obligation to inform governments and customers of this attack, and the fact the company chose to pay hackers and hide the massive breach is shocking. Pretending that an attack hasn't happened, or quietly paying attackers off only emboldens perpetrators further.

With MDBN (Mandatory Data Breach Notification) coming into effect in February 2018, businesses will be allowed 30 days to investigate a suspected breach, and plug any possible data loss, before notification is required. Businesses who fail to comply face fines of up to $1.8 million, much bigger than what Uber paid to hackers.

Businesses need to realise that the impact of breaches can be very serious - with knock-on effects on the organisation itself, employees and customers. To combat threats and ensure they remain compliant ahead of the MDBN, organisations must invest in minimising their risk appropriately with an appropriate cyber resilience strategy. This should also include a plan if something does go wrong.

"As the biggest cyber threat to businesses, ransomware attacks are becoming ever more widespread. In fact, in a survey we carried out earlier this year, 47% of respondents had been a victim of ransomware.

Even though the attackers were only able to obtain basic personal data within the Uber attack and no sensitive information such as location data or credit card numbers, this information can still be used by cyber criminals for identity theft purposes, which can ruin a person's credit rating.

Furthermore, in failing to notify its drivers and customers that their data had been breached, come May 2018 it could have been fined $800 million under the new European Union's GDPR, where companies are fined 4% of their worldwide annual revenue of the previous financial year.

This attack reiterates that the effects of an attack are no longer limited to the boardroom, or to the organisation itself. From our survey, more than three in ten admitted their customers (35%) and even employees (32%) had lost faith in their cyber security as a result of an attack. Perhaps most shockingly, around one in five reported a temporary closure of the business (21%) or a loss of customers altogether (17%)."

"Given the current climate around data security and breaches it is astonishing that Uber paid off the hackers and kept this breach under wraps for a year. The fact is there is absolutely no guarantee the hackers didn't create multiple copies of the stolen data for future extortion or to sell on further down the line.

A security breach of this size will potentially damage any business' reputation, but how a company behaves following a breach is vital. Potential victims deserve to be informed as soon as possible, so they can better protect themselves going forward - from changing passwords, and being aware they are now prime phishing targets. Being open and transparent and keeping customers informed is key, you can't simply sweep these things under the carpet.