Review each case from the following standpoints:

a$)$ Governance, security planning, policies and procedures

b$)$ Ethical, legal and security aspects

c$)$ User engagement

d$)$ Business management

e$)$ Integration among departments and groups

Breach $1$: Uber

In late $2016,$ attackers used a password obtained in an unrelated data breach to gain access to an Uber engineer$$s personal GitHub account. From this account, the attackers were able to access one of Uber$$s internal repositories, which contained a private key used to access Uber$$s datastores. These datastores contained unencrypted personal information for approximately $57$ million Uber drivers and riders. The attackers downloaded copies of this private user information violating the information$$s confidentiality. The attackers then contacted Uber, informed them that they had compromised Uber$$s databases, and demanded a ransom to delete the stolen data.

Uber was contacted by the attackers on November $14$th$,2016,$ and Uber chose to pay the ransom. Uber had the attackers sign non$-$disclosure agreements regarding the stolen information.

What Uber did not do$,$ however, was disclose the breach. Uber was also under investigation at the time for a different breach that occurred in $2014.$ Uber didn$$t disclose the breach until November $21,2017,$ following the appointment of a new CEO. In addition to being highly unethical, Uber$$s failure to disclose the breach was also illegal. In addition to the $$100,000$ ransom, Uber paid $$148$ million as part of the settlement.