TORONTO -- Privacy advocates in Canada are raising alarms at Uber's reluctance to disclose a year-old security breach that saw hackers steal the personal information of millions of customers around the world.
Uber admitted Monday that hackers stole names, email addresses and mobile phone numbers of 57 million riders but has still not said which customers had their data stolen including the number of Canadians affected.
The company specifies only that hackers took the driver's license numbers of 600,000 Uber drivers in the United States, and said it took steps to assure the data had been destroyed but did not disclose the hack for close to a year.
New York's state Attorney General has confirmed it has opened an investigation into the breach, with state laws requiring companies to give notice if data is stolen.
The company also faces potentially higher than usual fines from British authorities because the firm did not promptly disclose the hack.
Canada does not have laws requiring disclosure of data breaches, but NDP public safety critic Matthew Dube said in an email that the Uber incident shows the need for them.
"This type of hack is once again a reminder that the government needs to listen to the Privacy Commissioner and implement fines for companies who treat Canadians' information this way. The law also needs to be changed to force companies to divulge these hacks and be transparent."
The company still has not provided any details on the number of Canadians affected despite multiple requests, going against the importance of transparency in these matters, said Satyamoorthy Kabilan, director of national security at the Conference Board of Canada.
"That hiding of things, or that lack of communication over the breach, that is certainly a major concern for me."
He said it's important for companies to proactively disclose data breaches so that individuals can respond, so that security experts can learn from the breach, and to retain the trust of customers.
"What we've seen is organizations which are up front about what happened, they tend to retain the trust of users, whereas organizations that don't can be hit very badly."
He said that it's impossible to ensure that data breaches don't happen, so companies need to be prepared for when they do, including how to communicate with users.
"In today's complex, interconnected world, it's impossible to have 100 per cent security, so you also need to be prepared with what to do should something bad happen."
Uber waited until Tuesday to begin notifying the drivers with compromised driver's licenses, which can be particularly useful for perpetrating identify theft. For that reason, Uber will now pay for free credit-report monitoring and identity theft protection services for the affected drivers.
The San Francisco company ousted Travis Kalanick as CEO in June after an internal investigation concluded he had built a culture that allowed female workers to be sexually harassed and encouraged employees to push legal limits.
Khosrowshahi criticized Uber's handling of its data theft in his blog post.
"While I can't erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes," Khosrowshahi wrote. "We are changing the way we do business, putting integrity at the core of every decision we make and working hard to earn the trust of our customers."
That pledge shouldn't excuse Uber's previous regime for its egregious behaviour, said Sam Curry, chief security officer for the computer security firm Cybereason.
"The truly scary thing here is that Uber paid a bribe, essentially a ransom to make this breach go away, and they acted as if they were above the law," Curry said. "Those people responsible for the integrity and confidentiality of the data in-fact covered it up."
The Associated Press contributed to this report.