Feb 6, 2018

Senators slam Uber over 2016 data breach

Senators blasted Uber over their handling of a 2016 data breach and how it might affect a cybersecurity incentive program used to hide the breach from the public at a Senate Commerce Subcommittee hearing Tuesday.

Why it matters: The breach affected 57 million users worldwide, including 25 million in the United States. Uber opted not to notify the consumers whose data was stolen, instead paying the hackers to delete the data which was potentially in violation of many state breach notification laws. The fact that it took years to notify the public "raises red flags in this committee," said Senate Subcommittee on Consumer Protection, Product Safety, Insurance, and Data Security Chair Jerry Moran (R-KS).

Uber admits it was in the wrong: Uber Chief Information Security Officer John Flynn acknowledged that not notifying users was a mistake.

"There is no justification for that. We should have notified consumers…We did not have the right people in the room."
— Uber CISO John Flynn at Senate hearing.

Why the coverup might harm other security programs: Uber paid the hacker to delete the files using money from a bug bounty program, which incentivizes good guy hackers to alert companies of security flaws that companies can then fix independently.

  • Katie Moussouris, the chief executive of Luta Security and an internationally recognized bug bounty guru, told the subcommittee that paying a hacker who maliciously stole records using bug bounty funds "muddied" the difference between a beneficial program and extortion.
  • Sen. Moran agreed this might cause problems saying, "These substantive concerns should not completely outweigh [bug bounties'] innovative crowdsourced approach [to security]."

Go deeper

Trump removes watchdog overseeing rollout of $2 trillion coronavirus bill

Glenn Fine, acting Pentagon watchdog

President Trump on Monday replaced the Pentagon's acting Inspector General Glenn Fine, who had been selected to chair the panel overseeing the rollout of the $2 trillion coronavirus relief bill passed last month, Politico first reported.

Why it matters: A group of independent federal watchdogs selected Fine to lead the Pandemic Response Accountability Committee, but Fine's removal from his Pentagon job prevents from being able to serve in that position — since the law only allows sitting inspectors general to fill the role.

Coronavirus dashboard

Illustration: Sarah Grillo/Axios

  1. Global: Total confirmed cases as of 12 p.m. ET: 1,365,004— Total deaths: 76,507 — Total recoveries: 292,467Map.
  2. U.S.: Total confirmed cases as of 12 p.m. ET: 369,069 — Total deaths: 11,018 — Total recoveries: 20,003Map.
  3. Trump administration latest: Peter Navarro warned White House colleagues in late January about the massive potential risks from the coronavirus.
  4. Federal government latest: The public wants the federal government, not states, in charge of coronavirus — Testing capacity is still lagging far enough behind demand.
  5. States update: New York death toll surged to its highest one-day total as state predicts a plateau in hospitalizations.
  6. 2020 update: Wisconsin Supreme Court blocks the governor's attempt to delay in-person primary voting until June.
  7. What should I do? Pets, moving and personal health. Answers about the virus from Axios expertsWhat to know about social distancingQ&A: Minimizing your coronavirus risk.
  8. Other resources: CDC on how to avoid the virus, what to do if you get it.

Subscribe to Mike Allen's Axios AM to follow our coronavirus coverage each morning from your inbox.

Cuomo projects plateau in hospitalizations as coronavirus deaths surge

As the New York death toll surged to its highest one-day total on Tuesday, Gov. Andrew Cuomo projected that the state is reaching a plateau in coronavirus hospitalizations due to strict social distancing measures.

The big picture: Daily ICU admissions, intubations and the three-day hospitalization rate have all decreased, Cuomo said Tuesday. The daily death toll jumped by 731 to 5,489 — the "largest single-day increase" — but Cuomo cautioned that number of deaths is a "lagging indicator" due to the length that most critical patients are in the hospital for.