The settlement is part of a 50-state resolution over the data breach, which became public late last year.

Share story

Uber will pay Washington state about $5.8 million to settle a lawsuit stemming from a 2016 data breach involving 57 million customers and drivers that the ride-hailing giant failed to report.

About $2.2 million of that will go directly to Washington Uber drivers, whose driver’s license numbers and other personal information were obtained by hackers in the data breach, according to Washington Attorney General Bob Ferguson.

The settlement is part of a 50-state resolution over the data breach, which became public late last year, shortly after Dara Khosrowshahi took over as CEO.

Traffic Lab is a Seattle Times project that digs into the region’s thorny transportation issues, spotlights promising approaches to easing gridlock, and helps readers find the best ways to get around. It is funded with the help of community sponsors Alaska Airlines, CenturyLink, Kemper Development Co., NHL Seattle, PEMCO Mutual Insurance Company and Seattle Children’s hospital. Seattle Times editors and reporters operate independently of our funders and maintain editorial control over Traffic Lab content.

Learn more about Traffic Lab » | Follow us on Twitter »

In November 2017, the company announced that it had been hacked a year earlier and, instead of reporting the hacking, the company paid the hackers $100,000 to delete the data and pushed them to keep the theft secret.

Ferguson sued the company soon after, citing Washington law that requires businesses to inform both consumers and the Attorney General’s Office if personal data, like driver’s license numbers, is stolen.

Washington law does not require such notification for the breach of names, phone numbers and addresses, which is why only Uber drivers — and not Uber customers — will receive payouts from Wednesday’s settlement.

“Uber kept this massive data breach secret for more than a year, and jeopardized the personal information of thousands of drivers,” Ferguson said. “Uber’s conduct was inexcusable and unlawful.”

About 13,000 people who were Uber drivers in Washington in 2013 and 2014 will receive $170 each from the settlement, Ferguson said.

The remainder of the settlement money will go toward costs, fees and other consumer protection work at the Attorney General’s Office, a Ferguson spokesman said.

In a post on the company’s blog, Tony West, Uber’s chief legal officer, said that his first day on the job in 2017 was spent calling state and federal regulators about the data breach.

“Our current management team’s decision to disclose the incident was not only the right thing to do, it embodies the principles by which we are running our business today: transparency, integrity, and accountability,” West wrote.

Also on Wednesday, Uber announced that it signed a new lease for 115,000 square feet of office space in downtown Seattle. The company said it currently has about 350 employees in Seattle, not including drivers, which it classifies as independent contractors.

The new office space, slated to be ready next summer, will allow for a total of about 750 Uber employees in Seattle, the company said.