5 ms·
He's not accused of paying off the hackers. Rather he's accused of hiding the incident from an ongoing FTC investigation. They list various ways in which he sup
by pdw 6y ago
He's not accused of paying off the hackers. Rather he's accused of hiding the incident from an ongoing FTC investigation. They list various ways in which he supposedly concealed the hack from the FTC, e.g. they claim he set up up a false paper trail to make it look as if the hack was a harmless bug bounty submission.
- bagacrap 6y agoto be fair, the first sentence of the article does make it seem as though the crime was paying the hackers off
- bigmattystyles 6y agoWould you have to disclose a ransomware attack?
- bt1a 6y agoIf the ransomware attack doesn't exfiltrate any data I wouldn't think you'd have to disclose it. For this case, isn't it impossible to prove that the hackers didn't keep this data and sell it? Even if the hackers were fully cooperative with Uber, there's no guaranteeing that. In that case, I would think you'd have to notify the public.
- mike_d 6y agoYes, if there is a federal investigation you cannot conceal or refuse to disclose details. There isn't a clear answer on proactive reporting. Depending on the type of business you have, what data you hold, the scale of the attack, etc. Some specific professions have mandatory reporting laws that may cover individuals that work for you. (see https://www.lw.com/thoughtLeadership/LW-ransomware-attacks-when-is-notification-required https://www.lw.com/thoughtLeadership/LW-ransomware-attacks-w... for a detailed answer) The generally accepted best practice is that every ransom attack be reported to the Cybersecurity and Infrastructure Security Agency. In the specific case of Uber, the incident involved scanned passports. The law is pretty clear that you have to report any compromise of passport data to the State Department.