Washington state Attorney General Bob Ferguson (D) is suing Uber for failing to disclose a massive data breach that left the personal information of 57 million people exposed.
Ferguson said the ride-sharing company violated state law by not informing consumers that their information had been stolen in the 2015 breach.
“Washington law is clear: When a data breach puts people at risk, businesses must inform them,” Ferguson said in a statement on Tuesday. “Uber’s conduct has been truly stunning. There is no excuse for keeping this information from consumers.”
{mosads}The law requires companies to disclose data breaches to affected consumers and the attorney general’s office within 45 days. Ferguson says that Uber did not notify his office until this month, more than a year after the breach.
The lawsuit was filed Tuesday in King County Superior Court.
The attorney general is seeking a penalty of up to $2,000 for each day past the 45-day deadline that Uber waited to disclose the breach.
Last week, Uber CEO Dara Khosrowshahi revealed the massive breach that took place under his embattled predecessor, Travis Kalanick. The New York Times later reported that the company had paid a $100,000 ransom to the hackers responsible in an effort to sweep the incident under the rug.
Uber said in a statement Wednesday that the company is committed to turning over a new leaf in the wake of the Kalanick era.