Update: Uber Data Breach

30 Nov 2017 12:39 PM

An update to the official statement from the National Cyber Security Centre on the Uber data breach.

A spokesperson for the NCSC said:

“Uber have said that the October 2016 data breach affected approximately 2.7 million user accounts in the UK.

“We assess that the stolen information does not pose a direct threat to people or allow direct financial crime. Indications are that the breach involved user names, email addresses and mobile phone numbers.

“People who are concerned should continue to be vigilant and follow the advice on the National Cyber Security Centre website.”

Further information

• Companies should always report any cyber attacks to the NCSC immediately. The more information a company shares in a timely manner, the better able we are to support them and prevent others falling victim.
• If a member of the public thinks they have been a victim of cyber crime or cyber-enabled fraud, they should contact Action Fraud.
• If you have been told that your personal details, such as your password, may have been accessed, you should ensure those details are not used on any other accounts. Victims of cyber crime should be vigilant against suspicious phone calls or targeted emails. Further advice can be found here.

NCSC advice on phone calls

• If you do receive a phone call that is suspicious - for example, one that asks you for security information - do not divulge any information, and hang up.
• Pick up the phone and make sure there is a dial tone to ensure the caller is not still on the line.
• Contact the organisation that the caller claimed to be from – never using the details they provided during the call.

NCSC advice on targeted emails

• Fraudsters can use the data they’ve acquired to make their phishing messages look much more credible, including using real names and statements such as: 'To show this is not a phishing email, we have included the month of your birth and the last 3 digits of your phone number'.
• These phishing messages may not relate to the organisation that has been breached, and may use more well-known brands. The NCSC has guidance on protecting yourself from phishing.
• Usually, if you are the target of a phishing message, your real name will not be used. However, if fraudsters do have your name, people will need to be extra vigilant around any message that purports to be from an organisation they deal with - especially when there are attachments or links which take people to sites asking for more personal information.