An Atlanta law office has filed a class-action lawsuit against Uber over the 2016 data breach that compromised the personal information of roughly 57 million consumers.
The lawsuit — filed in U.S. District Court in Atlanta by Beasley, Allen, Crow, Methvin, Portis & Miles — faults Uber for a “colossal data security breach as well as a deliberate and systematic cover-up scheme to hide the extent and nature of the breach from regulators” and customers.
Uber publicly acknowledged in November 2017 that it paid hackers at least $100,000 to conceal the October 2016 computer break-in, the Beasley Allen lawsuit said. The breach took place before Dara Khosrowshahi took over as CEO from embattled co-founder Travis Kalanick.
The lawsuit says plaintiff James Wood, of DeKalb County, has used the Uber ridesharing app to hail rides throughout the metro Atlanta area. Woods and the class members had their “personal information exposed to sophisticated cyber-criminals who trade such information on an international black market,” the March 1 complaint says.
Uber declined to comment on the lawsuit, spokeswoman Evangeline George said.
Uber is one of a plethora of companies that have been injured by similar attacks in recent years, including metro Atlanta-based companies such as Home Depot and Equifax. The latter was hit with class-action lawsuits over a massive data breach just months before the Uber hack was announced.
The Beasley Allen law firm, which also has a primary office in Montgomery, Alabama, is familiar with such class actions. The firm filed an Equifax case that was later consolidated, and was on court-appointed steering committees in cases against Target and Home Depot, according to principal Archie Grubb.
The Uber case in Georgia joins one recently filed in Pennsylvania by the state’s attorney general, who said Monday that 43 state attorneys general are investigating the data breach, according to The Hill.
Grubb said the firm isn’t aware of another Uber class action filed in Georgia, but it recognizes that the various cases likely will be consolidated in some other jurisdiction. A panel of federal judges will discuss the matter at a hearing on March 29 in Atlanta.
The Georgia lawsuit seeks restitution and compensatory damages, and an injunction instructing Uber, its subsidiaries and affiliates from “engaging in the same acts or omissions that led to the data security breach.”
Uber is based in California but could be served at a registered address in Lawrenceville. The court has personal jurisdiction over Uber because the plaintiff’s claims arise out of the company’s contacts with Georgia, the lawsuit said.