In late 2016, two people outside the company accessed the personal information of 57 million Uber users including names, email addresses and phone numbers, the company said. Hackers also accessed driver's license numbers of around 600,000 drivers in the United States. The 600,000 was included in the total number of affected users, CNN reports.
The company did not alert victims or regulators of the breach when they discovered it happened.
Uber CEO Dara Khosrowshahi said in a statement he recently learned of the breach.
Khosrowshahi, who became CEO in August, said he launched an investigation into why the company did not alert authorities or individuals affected by the hack. He said, "two of the individuals who led the response to this incident are no longer with the company." Khosrowshahi said the company is now notifying regulatory authorities.
Bloomberg reports that Joe Sullivan, Uber's chief security officer, is no longer with the company. Uber would not confirm to CNNMoney which individuals had left the company.
"At the time of the incident, we took immediate steps to secure the data and shut down further unauthorized access by the individuals," Khosrowshahi said in the statement.
"We subsequently identified the individuals and obtained assurances that the downloaded data had been destroyed. We also implemented security measures to restrict access to and strengthen controls on our cloud-based storage accounts," he said.
Uber did not say how hackers assured the company the stolen data was destroyed. Bloomberg reported that Uber paid them $100,000. Uber would not confirm it paid this ransom.
According to the company, no location history, credit card numbers, Social Security numbers, or dates of birth were downloaded in the hack. Uber said it is providing free credit monitoring to drivers who had their license numbers exposed.