Senators blasted Uber over their handling of a 2016 data breach and how it might affect a cybersecurity incentive program used to hide the breach from the public at a Senate Commerce Subcommittee hearing Tuesday.

Why it matters: The breach affected 57 million users worldwide, including 25 million in the United States. Uber opted not to notify the consumers whose data was stolen, instead paying the hackers to delete the data which was potentially in violation of many state breach notification laws. The fact that it took years to notify the public "raises red flags in this committee," said Senate Subcommittee on Consumer Protection, Product Safety, Insurance, and Data Security Chair Jerry Moran (R-KS).

Uber admits it was in the wrong: Uber Chief Information Security Officer John Flynn acknowledged that not notifying users was a mistake.

"There is no justification for that. We should have notified consumers…We did not have the right people in the room."
— Uber CISO John Flynn at Senate hearing.

Why the coverup might harm other security programs: Uber paid the hacker to delete the files using money from a bug bounty program, which incentivizes good guy hackers to alert companies of security flaws that companies can then fix independently.

  • Katie Moussouris, the chief executive of Luta Security and an internationally recognized bug bounty guru, told the subcommittee that paying a hacker who maliciously stole records using bug bounty funds "muddied" the difference between a beneficial program and extortion.
  • Sen. Moran agreed this might cause problems saying, "These substantive concerns should not completely outweigh [bug bounties'] innovative crowdsourced approach [to security]."

Go deeper

Updated 12 mins ago - Politics & Policy

Coronavirus dashboard

Illustration: Sarah Grillo/Axios

  1. Global: Total confirmed cases as of 9 a.m. ET: 31,647,930 — Total deaths: 971,711 Total recoveries: 21,776,599Map.
  2. U.S.: Total confirmed cases as of 9 a.m. ET: 6,897,661 — Total deaths: 200,818 — Total recoveries: 2,646,959 — Total tests: 96,612,436Map.
  3. Health: Hospitals want more time to repay pandemic loans — Supply shortages continue to plague testing.
  4. Business: The high-wage jobs aren't coming back
  5. Vaccines: Johnson & Johnson begins large phase 3 trial — The FDA plans to toughen standards.
  6. Sports: Less travel is causing the NBA to see better basketball.
Kendall Baker, author of Sports
55 mins ago - Sports

Less travel is causing the NBA to see better basketball

Illustration: Aïda Amer/Axios

In addition to keeping out the coronavirus, the NBA bubble has also delivered a stellar on-court product, with crisp, entertaining play night in and night out.

Why it matters: General managers, athletic trainers and league officials believe the lack of travel is a driving force behind the high quality of play — an observation that could lead to scheduling changes for next season and beyond.

Senate Republicans release report on Biden-Ukraine investigation with rehashed information

Sen. Ron Johnson (R-Wis.). Photo: Tom Williams/CQ-Roll Call, Inc via Getty Images

Senate Republicans, led by Sens. Ron Johnson (R-Wis.) and Chuck Grassley (R-Iowa), on Wednesday released an interim report on their probe into Joe Biden and his son's dealings in Ukraine.

Why it matters: The report's rushed release ahead of the presidential election is certainly timed to damage Biden, amplifying bipartisan concern that the investigation was meant to target the former vice president's electoral chances.

Get Axios AM in your inbox

Catch up on coronavirus stories and special reports, curated by Mike Allen everyday

Please enter a valid email.

Subscription failed
Thank you for subscribing!