Two US states on Wednesday confirmed they are investigating Uber’s cover-up of a hack at the ride-sharing giant that compromised the personal information of 57 million users and drivers.

Uber purportedly paid data thieves $100,000 to destroy the swiped information — and remained quiet about the breach for a year.

That decision evidently came despite a promise by the firm to “adopt leading data security protection practices” in a settlement with New York attorney general Eric Schneiderman.