Uber data breached via Genova Burns law firm, unknown number of drivers affected

(Image source: Uber, 2020)

One-sentence summary:

In January 2023, Uber driver data was breached via Genova Burns law firm, potentially impacting an unknown number of drivers.

Who was involved?

Uber, Uber drivers, Genova Burns LLC, and a threat actor.

What was the timeline?

January 23, 2023: Attacker gains initial access to Genova Burns and potentially exfiltrates Uber drivers’ data

January 31, 2023: Genova Burns discovers unusual activity on its network

March 1, 2023: Genova Burns confirms they have been breached and notifies Uber

March 31, 2023: Uber notifies the Maine Attorney General’s Office and Uber drivers

What occurred?

A threat actor broke into Genova Burns, Uber’s law firm at one point, and potentially breached Uber’s drivers’ data, including: “name and Social Security number and/or Tax Identification number” (Genova Burns, 2023, p. 1). At the time of writing, no complete headcount has been found for all potentially affected drivers (Engrav, 2023).

Estimated costs:

“outside forensic and data security specialists,” associated incident response costs, breach notification costs, 12 months of Kroll identity monitoring, M-F call center

Involved laws:

State laws: Maine: 10 M.R.S.A. § 1346

Root cause:

TBA or N/A (see disclaimer)

Lessons learned:

TBA or N/A (see disclaimer)

Sources:

Engrav, R. (2023). Data Breach Notifications. In Office of the Maine Attorney General. Office of the Maine Attorney General. Retrieved April 4, 2023, from https://apps.web.maine.gov/online/aeviewer/ME/40/7727ef33-24df-4686-97d0-7c3fb6d3cc22.shtml

Genova Burns. (2023). NOTICE OF DATA BREACH. In Data Breach Notifications (ELN-17324). Maine Attorney General. Retrieved April 4, 2023, from https://apps.web.maine.gov/online/aeviewer/ME/40/7727ef33-24df-4686-97d0-7c3fb6d3cc22/85299fa8-b377-463a-a334-6a20788e20c3/document.html

Uber. (2020, May). Uber-Logo-2018-present.jpg. Logos-world.net. https://logos-world.net/wp-content/uploads/2020/05/Uber-Logo-2018-present.jpg

About Post Author

Kyler Kent CISSP

Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike’s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation—turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master’s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect – Professional, AWS Security – Specialty, and multiple CrowdStrike credentials. He writes to close the gap between “what the textbook says” and what analysts actually do on shift with his published book: "SOC Analyst Career Guide" (ISBN-13: 9781835467466). https://linktr.ee/kentprotect.com Corrections: [email protected]

http://kylerkent.com