These are absolutely not white-hat hackers. In order for a breach of this nature to be white-hat, they would have to be acting openly, and within the parameters

These are absolutely not white-hat hackers. In order for a breach of this nature to be white-hat, they would have to be acting openly, and within the parameters of Uber's bug bounty program (https://hackerone.com/uber https://hackerone.com/uber). I have yet to see a bug bounty program that would allow the pen-testers to access private user data en-masse (I don't even think a company could legally allow this). Anonymously extorting a company after stealing its data is a black-hat activity any way you look at it. If Uber didn't have a bounty program or responsible disclosure policy, and the hackers didn't download the user data, but reported it in a manner consistent with other responsible disclosures after discovering a means to access, then it would be grey-hat at best.