Uber investigators have discovered that the data breach incident last year could be traced back to a Lyft executive.
The ride-sharing app company has filed a "John Doe" lawsuit in a San Francisco court to gather information and confirm the identity of the person who accessed the database once and have compromised the names and license numbers of more than 50,000 drivers, as HNGN previously reported. While names and license numbers are not enough for identity theft, they can become a problem when combined with credit card information.
Two sources familiar with the matter told Reuters eight months later that Uber's probe had identified that the Comcast IP address that was used to get the security key for the database belongs to Lyft's technology chief, Chris Lambert. The court documents stated that even if the Comcast IP address was not the actual IP address used by the hacker, it could help reveal the identity of the hacker, who used a virtual private network service based in a Scandinavian country.
The Uber investigators persuaded a federal judge to order Comcast to release the information of the subscriber, presumed to be Lambert, but the cable company declined to protect the reputation of their client.
"This Comcast IP address is associated with somebody who had been scraping driver data from the Uber website,” Uber attorney James G. Snell, of Perkins Coie, told U.S. District Judge Laurel Beeler in San Francisco in July, according to The Wall Street Journal. “It matters who that is. If this was a competitor.”
Lyft spokesman Brandon McCormick denied the allegation of Lambert's involvement on the data breach and said that they also made an internal investigation on their end. They concluded that “there is no evidence that any Lyft employee, including Chris, downloaded the Uber driver information or database, or had anything to do with Uber’s May 2014 data breach."
Lyft is one of Uber's major competitors in the U.S.
