Uber fined £385,000 for failing to protect customers' personal info

According to the Information Commissioner's Office (ICO), a series of avoidable data security flaws allowed the personal details of around 2.7 million UK customers to be accessed and downloaded by attackers. The details included full names, email addresses and phone numbers.

The records of almost 82,000 drivers based in the UK – which included details of journeys made and how much they were paid – were also taken during the incident in October and November 2016.

However, the customers and drivers affected were not told about the incident for more than a year. Instead, Uber paid the attackers responsible $100,000 to destroy the data they had downloaded. Information about the attack was finally released in November last year.

I'm worried about the cyber attack – what should I do?

We've asked Uber how customers can check if their data was taken in the attack, and will update this story when we hear back.

In the meantime, there are a number of things you can do to try and protect yourself:

• Regularly check your Uber account for unexplained activity. If you notice anything unusual, click 'Help' in your app, then 'Account and payment options', then 'I have an unknown charge' and then 'I think my account has been hacked'.

• Watch out for scams. Be alert and watch out for potential scam emails or calls.

• Change your password. Uber has not said any passwords were taken, but if you're worried – for example, if your password used info that could be guessed from your personal details – change it, and change it on any other sites where you use the same one. (Ideally you should use a unique password for each site – see our Password Security guide for full help).

What does the ICO say?

The ICO's director of investigations Steve Eckersley said: "This was not only a serious failure of data security on Uber's part, but a complete disregard for the customers and drivers whose personal information was stolen.

"At the time, no steps were taken to inform anyone affected by the breach, or to offer help and support. That left them vulnerable."

What does Uber say?

An Uber spokesperson said: "We're pleased to close this chapter on the data incident from 2016. As we shared with European authorities during their investigations, we've made a number of technical improvements to the security of our systems both in the immediate wake of the incident as well as in the years since.

"We've also made significant changes in leadership to ensure proper transparency with regulators and customers moving forward. Earlier this year, we hired our first chief privacy officer, data protection officer, and a new chief trust and security officer. We learn from our mistakes and continue our commitment to earn the trust of our users every day."