News has broken that last year, hackers downloaded the personal information of 57 million Uber riders and drivers from a third-party server. In response, the ride-hailing company paid those attackers $100,000 to delete their copy of the data, and then reportedly tracked them down to get them to sign non-disclosure agreements to keep the breach quiet. While that may have kept Uber out of another PR nightmare — at least for a time — it’s definitely not the course of action companies like Uber are supposed to take when something like this goes down.

Click the audio player above to hear the full story.