An intruder then used that key to access an unencrypted file that contained the compromised information in May 2014. Uber discovered the breach in September 2014, at which point it took steps to prevent further unauthorized access. Uber's settlement with the FTC to resolve these issues may sound familiar, as Uber entered into a very similar settlement with the New York Attorney General's office on January 6, 2016, over essentially the same set of circumstances.5 That settlement required Uber to implement and maintain a number of specific data security practices, including encrypting and limiting employee access to geolocation information, and required Uber to pay a $20,000 penalty for failing to provide timely notice of the breach to affected drivers. The Assurance of Discontinuance that details the settlement, however, provides little to explain the basis for that settlement other than the failure to timely notify drivers of the breach.