French data protection watchdog fines Uber €400,000 in connection with 2016 data breach

The Commission Nationale de L’Informatique et des Libertés (CNIL), the French data protection authority, announced that it is fining France €400,000 ($460,000) for its 2016 data breach that affected 57 million users worldwide, including 1.4 million users in France.  According to the CNIL’s report, hackers used employee login and password credentials to connect to Uber’s Amazon Web Services account and download user data.  CNIL criticized Uber’s failure to use two-factor authentication and its purported attempt to cover up the breach by paying the hackers $100,000 to delete the data set.  Uber was previously fined £385,000 ($490,000) and €600,000 ($690,000) by British and Dutch authorities, respectively.

CNIL press release