Dutch Regulator Slaps Uber With Record Fine Over Automated Account Bans

Uber is facing a staggering bill after Dutch data protection authorities slapped the ride-hailing company with a fine of 825 million euros ($964 million). The penalty stems from the company’s use of automated software to suspend driver accounts — sometimes permanently — without any human review to catch errors.

The Dutch Data Protection Authority announced the fine on Friday, saying Uber violated the European Union’s General Data Protection Regulation. The GDPR explicitly prohibits fully automated decision-making that significantly affects individuals, and the regulator claims Uber crossed that line repeatedly.

This is the fourth time the Dutch authority has fined Uber. The previous record was set in 2024, when the company was hit with a 290 million euro ($324 million) penalty for transferring personal details of European drivers to the United States without adequate protection.

What Did Uber Actually Do Wrong?

According to the regulator, the violations took place between 2018 and 2022. During that period, Uber’s automated systems could suspend or deactivate driver accounts based on algorithmic assessments. The problem? No human was checking whether those automated decisions were correct.

The authority also said Uber failed to properly inform drivers about how its automatic decision-making worked. Drivers were left in the dark about the very systems that could end their ability to earn a living.

The GDPR’s Stance on Automation

Article 22 of the GDPR gives individuals the right not to be subject to decisions based solely on automated processing when those decisions produce legal or similarly significant effects. In plain terms: if a machine is going to make a call that could cost someone their livelihood, a human needs to be in the loop.

Uber’s system, as described by the regulator, appears to have skipped that step entirely.

Uber’s Response: We Disagree, We’ll Appeal

Uber didn’t take the news quietly. The company said it disagrees with both the decision and the fine, and confirmed it will file an appeal.

“The (Data Protection Authority) examined historic policies that were discontinued years ago,” the company said in a written statement. “We take decisions that affect drivers’ ability to earn extremely seriously and we’re fully committed to fair treatment. This includes human reviews, robust safeguards, and the opportunity for drivers to appeal our decisions if they believe we made a mistake.”

The company’s argument hinges on timing — it claims the practices in question were old and already scrapped. The regulator, however, maintains that the violations happened on its watch and that the fine is justified.

What This Means for the Gig Economy

This ruling sends a clear signal to every platform that relies on algorithmic management. If you’re using automated systems to make decisions about workers — whether they’re drivers, couriers, or freelancers — you need human oversight and transparent communication.

The fine is a reminder that GDPR isn’t just about data breaches and consent pop-ups. It’s also about protecting individuals from the whims of opaque algorithms. For companies like Uber, Lyft, and DoorDash that have built their business models on algorithmic matching and rating, this is a warning shot.

Related: Personal Information Exposed in Apollo Global Data Breach

Related: TikTok Reaches $400 Million Settlement With US Justice Department Over Children’s Privacy

The Bigger Picture: A Growing Regulatory Crackdown

Uber has been in the crosshairs of European regulators for years. The 2024 fine over US data transfers was itself a landmark penalty. Now this new fine nearly triples that amount.

The pattern is clear: European authorities are getting serious about enforcing data protection rules against Big Tech. And they’re not afraid to use their calculators.

For Uber, the appeal process could drag on for years. But even if the fine is reduced or overturned, the reputational damage is done. The message to the industry is simple: algorithmic decisions need human accountability.

Related: Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal

What Drivers Should Know

If you’re a driver for any ride-hailing platform, this case highlights your rights. Under GDPR, you have the right to:

• Know when automated decision-making is being used on you
• Request human intervention in automated decisions
• Express your point of view and contest automated decisions
• Receive meaningful information about how the algorithm works

If a platform isn’t providing these protections, it may be in violation of the law. The Dutch regulator just proved that with a nearly billion-dollar exclamation point.

The Dutch Data Protection Authority has set a precedent that other European regulators may follow. For Uber, the fight is just beginning. For the rest of the gig economy, the lesson is already written.

HollowGraph: A New Espionage Implant

Security researchers at Group-IB have uncovered a sophisticated espionage implant that turns a hijacked Microsoft 365 calendar into a covert command-and-control (C2) channel. Dubbed HollowGraph, the malware uses calendar events dated to the year 2050 to hide operator instructions and smuggle stolen files out of compromised networks.

The technique is clever — and alarming. By routing tasking and exfiltration through legitimate Microsoft Graph API traffic, the activity blends in with normal cloud usage. It doesn’t trigger the usual alarms that flag suspicious network connections or unknown domains.

How the Attack Works

HollowGraph operates by compromising a Microsoft 365 account, then creating calendar events that contain encrypted payloads. The dates are set far in the future — 2050 — to avoid raising immediate suspicion. These events carry attachments that serve as commands from the attacker or as containers for stolen data.

Group-IB notes that this approach allows the malware to use the victim’s own cloud infrastructure as a communication bridge. The attacker and the compromised endpoint communicate through a shared calendar, making detection particularly difficult.

Why 2050?

The choice of 2050 is deliberate. It’s far enough out that the events won’t clutter the near-term calendar or trigger reminders. It’s also an unusual enough date to be overlooked by security tools that might scan for anomalies in event metadata.

Detection and Mitigation

Group-IB’s research highlights the need for organizations to monitor Microsoft 365 activity more closely, especially calendar events with unusual patterns. Here are some practical steps to protect against this type of attack:

• Audit calendar events for suspicious attachments, especially those dated far in the future.
• Enable logging for Microsoft Graph API calls and review them for unusual patterns.
• Use conditional access policies to restrict calendar access to trusted devices and locations.
• Deploy endpoint detection and response tools that can spot unusual process behavior.

For more on how attackers abuse cloud services, see our breakdown of recent Microsoft 365 phishing campaigns and cloud-based C2 techniques.

The Bigger Picture

HollowGraph is a reminder that attackers are constantly finding new ways to exploit the tools we rely on daily. Calendar apps, email, and file-sharing services are all potential vectors. The key to defense is visibility — knowing what normal looks like in your environment so that anomalies stand out.

Group-IB has not disclosed the target of the campaign, but the sophistication suggests a nation-state actor. The malware’s focus on stealth and persistence points to a long-term espionage operation.

As cloud adoption grows, expect more malware like HollowGraph to emerge. The lesson is clear: security teams must treat every aspect of their cloud infrastructure — even a calendar — as a potential attack surface.

The New Travel Risk: Your Hotel’s Wi-Fi Gateway

That free Wi-Fi in the hotel lobby might be doing more than just checking you in. A new campaign is targeting the Microsoft 365 accounts of traveling corporate employees by compromising the very gateways that manage public internet access.

Security firm ReliaQuest has been tracking the activity since at least June 2026. The attackers aren’t setting up rogue hotspots. Instead, they’re breaking into the small office/home office (SOHO) routers that power captive portal networks at shared venues across the US, India, and Saudi Arabia.

The goal? Redirect unsuspecting users to attacker-controlled infrastructure designed to harvest their credentials.

How the Attack Unfolds

The hackers modify the DNS configurations of compromised routers. When a traveler connects to the hotel or conference center network and tries to browse the web, they’re silently sent to a malicious server.

From there, the attackers use an adversary-in-the-middle (AitM) technique. This allows them to intercept traffic in real time, capturing not just login credentials but other sensitive information as it flows between the user and legitimate services.

ReliaQuest identified four attacker-registered domains used in the campaign, all serving Microsoft-impersonation lures to trick victims into entering their work credentials.

Who’s Being Targeted

The firm observed traffic from organizations across financial services, professional services, legal, health care, energy, and retail. As ReliaQuest notes, this isn’t sector-specific targeting. It’s a campaign that goes after traveling employees wherever they connect.

That means airports, conference centers, healthcare facilities, universities, and event venues all face a similar attack surface. If you run captive Wi-Fi services, you’re in the crosshairs.

A Familiar Playbook with a Twisted Ending

The activity bears some resemblance to the previously documented FrostArmada campaign, which was attributed to APT28 — also known as Forest Blizzard and Fancy Bear. That group is believed to be linked to Russia’s General Staff Main Intelligence Directorate (GRU).

But there’s a key difference. The new attacks use DNS poisoning to redirect all users to attacker-controlled infrastructure. FrostArmada, by contrast, didn’t rely on this technique.

ReliaQuest suggests this could be “potentially an indicator of a less sophisticated or less careful actor than APT28.” The tactics, techniques, and procedures (TTPs) show the threat actor is at least reusing APT28’s tradecraft, but the overlap isn’t complete.

“The targeting of captive portal appliances — especially those used in hotels and conference centers — wasn’t previously documented in FrostArmada reporting,” ReliaQuest notes. “Attacker infrastructure also differed from prior FrostArmada activity. The domain registrations and IP addresses used don’t align with infrastructure previously seen in APT28 campaigns.”

What This Means for Security Teams

This campaign highlights a blind spot in many corporate security strategies. You can patch your endpoints, enforce multi-factor authentication, and train your staff on phishing emails — but you can’t control the Wi-Fi router at a Marriott in Mumbai.

For organizations with frequent travelers, the implications are serious. A single compromised login could give attackers a foothold in your Microsoft 365 environment, leading to data exfiltration, business email compromise, or worse.

Practical Defenses for Road Warriors

• Use a VPN: A reputable VPN encrypts traffic before it hits the network, making DNS poisoning and AitM attacks far less effective.
• Verify captive portals: Before entering credentials on any public Wi-Fi login page, double-check the URL and ensure it matches the venue’s official portal.
• Enable phishing-resistant MFA: Hardware security keys or certificate-based authentication can stop credential theft even if passwords are compromised.
• Monitor for anomalous logins: Watch for sign-ins from unusual locations or devices, especially for accounts belonging to frequent travelers.

The Bigger Picture: Public Wi-Fi Is a Persistent Threat

This isn’t the first time public Wi-Fi has been weaponized, and it won’t be the last. The Mirai botnet targeting flawed D-Link routers shows how vulnerable these devices can be. And China-linked APT groups expanding their backdoor arsenals suggest the threat landscape is only getting more complex.

For security leaders, the takeaway is clear: treat every public network as hostile. The convenience of hotel Wi-Fi isn’t worth handing over your corporate credentials to an unseen adversary.

As ReliaQuest’s findings demonstrate, the attackers are adapting. They’re finding new ways to exploit the trust we place in everyday technology. It’s time for defenders to adapt too.