The Dutch data protection agency (DPA) has fined taxi company Uber €600,000 for failing to report a data leak which took place in 2016.

Uber was hacked in 2016 and the email addresses, names and phone numbers of 57 million users came into the hands of hackers. In the Netherlands, 174,000 clients and drivers were affected.

Uber paid the hackers €100,000 to keep quiet about the hack and did not go public with the news, which only emerged a year later. By law the company should have informed the DPA within 72 hours.

The taxi company reached an out of court settlement in the US equivalent to some €130m and was also fined €434,000 in Britain.