Even if you only count the 2 months since Khosrowshahi learned about the 2016 hack, Equifax still took less time (6 weeks) to do its own secret investigation of its hack and publish the results - and yet it was vilified by the public and press for its slow disclosure.

Plus, Khosrowshahi told Softbank about the ongoing investigation 3 weeks before the rest of us - while this information was important to Softbank, it would also be important to any other potential investor, and we do not know whether any others were indeed told about it.

6 weeks really isn't a long time. They had to locate a pentesting firm that specializes in forensic investigation, schedule it, conduct it, then decide what to do.

I know it's an unpopular opinion. But both Uber and Equifax took similar amounts of time.

Uber had a new CEO stepping in and learning how to run the company from zero, and this was one of the many, many things he had to worry about; a threat that was reportedly neutralized.

Equifax leaked the social security information and credit histories of an enormous number of Americans, when their main job is to keep it safe and available.

It’s a little silly to compare the timelines. They’re just completely different.

> when their main job is to keep it safe and available.

LOL. I don't think their incentives are in line with that at all. It may be what we want but then we're just lying to ourselves.

> learning how to run the company from zero

Is handover a thing among CEO’s?

Depends who equitable the split from the old CEO was. Is he retiring out of his own free will and handing over the company to trusted successor he helped pick or is he being forcefully ousted by the board after a massive bitter proxy battle.

Furthermore, it is not as if the breach had just been discovered: Uber had already investigated the issue to the point where it paid the blackmail, so I suspect the then chief of security and his staff already knew enough to make a responsible, if preliminary, disclosure - and to initiate the credit-monitoring program.

Completely agree. The "media" is notoriously writing headlines that cause outrage. Outrage sells and keeps them in business.

If people chose non-shouty news sources, the media wouldn’t shout. They only do it because we (generic we) prefer media that does that.

And? These companies are exploiting psychology in all humans (at least on average). To put ownership on the consumers only is very silly. It's like excusing the behavior of sugar, alcohol, tobacco, pharmaceutical, etc. and saying "If you consume it's your fault" and ignoring the manipulative practices of these organizations.

What's up with the "scare quotes?"

This media then blames everything on Facebook and twitter and google, and write an article everyday about congressional hearing and how Americans are not trusting tech any more.

Complaining about headlines is becoming a convenient way to avoid talking about the substantive issues - which is another strike against them.

I would think it would be to his advantage to disclose it as well. To put another nail in the coffin for Kalanick ever coming back as CEO.

He should have come forward with it immediately while still conducting the internal investigation. Not only do customers deserve to know as soon as possible, but it would have established trust in him as CEO and cemented that Kalanick needed to be gone.

You mean he should have told those affected without knowing what actually was leaked, the scope and impact of the leak, and the whereabout of the leaked data, or making sure there is enough safeguard in place so no one can repeat the same attack? Does not sound more responsible?

The keyword is responsible disclosure, not just disclosure.

Thats misusing the term responsible disclosure.

Once they knew any something was leaked, no matter what, the responsible move is to inform everyone to give them a chance to lock down their shit. More time or knowledge of where the data is won't save anyone.

As for the "other attacker" excuse, how would that work? Just from knowing that data was leaked no new attacker can deduce the weakness used.

The PR damage to the company would be much greater due to people speculating a worst case scenario. Followed up by the fact people wouldn't care anymore when the investigation is finished.

Is that enough though? Since they are supposed to reveal their hack a week after it happened, going public straight away is the best thing to do.

I completely agree. Taking months to let tens of millions of people know their information was compromised isn't acceptable, no matter whether or not you know all the details about it. (The obvious exception being an as-of-yet insecure point of attack.)

Do you think investors would have pressured this approach rather than have an immediate disclosure to save PR?

That’s not how you’re supposed to handle hacks, especially when other people’s data is compromised. You’re leaving victims needlessly exposed.

California law requires notification in "the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subdivision (c), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system."

This sounds like something well, well beyond that. So as far as I'm concerned, the new CEO seems like nearly as much of as scofflaw as the old.

[1] http://leginfo.legislature.ca.gov/faces/codes_displaySection...