Khosrowshahi said that what he learned about Uber's failure to notify users or regulators prompted corrective actions.
The hackers also accessed driver's license numbers of around 600,000 drivers in the United States.
Khosrowshahi, who became CEO in August, said he launched an investigation into why the company did not alert authorities or affected individuals.
"Companies like Uber will not be able to hide the breaches of our personal data from us or face penalty", she said, without mentioning a sum for an European Union fine for Uber. Uber said it believes the information was never used but declined to disclose the identities of the attackers.
The company's admission that it failed to disclose the breach came as Uber was seeking to recover from a series of crises that culminated in the Mr Kalanick's ousting in June.
"We subsequently identified the individuals and obtained assurances that the downloaded data had been destroyed", Khosrowshahi wrote. The laws generally apply if a victim of a hack lives in that state.
"Sadly, it's all too common that developers are allowed to copy live production data for use in development, testing and QA". Is a ransomware attack technically a data breach?
This is one of the larger breaches to have been disclosed by a major firm, but should you be anxious? The New York attorney general has opened an investigation, a spokeswoman said. "What I learned, particularly around our failure to notify affected individuals or regulators a year ago, has prompted me to take several actions".
"Senate Commerce Committee should hold hearing to demand Uber explain their outrageous breach - and inexplicable delay in informing its consumers and drivers", Blumenthal, a Connecticut Democrat, said in a tweet on Wednesday.
Will you stop using Uber as a result of the breach?
The FTC hasn't commented on whether or not it will investigate the matter, but an agency spokesperson said in an emailed statement that it is "closely evaluating the serious issues raised".
Uber, under new management, is desperately trying to make up for past mistakes.
"Unfortunately, we frequently see SSH keys that provide access to AWS left unprotected in GitHub", he said.
Other countries have similar rules regarding breaches.
"If U.K. citizens were affected then we should have been notified so that we could assess and verify the impact on people whose data was exposed", said James Dipple-Johnstone of the U.K. Information Commissioner's Office. Credit reporting service Equifax waited several months before revealing this past September that hackers had carted off the Social Security numbers of 145 million Americans. In 2013, a hack of Yahoo impacted very single account - 3 billion in total.
The massive breach took place in 2016, and the ride-sharing company tried to cover it up for more than a year, paying the hackers to delete the stolen data.
- Affair site cracked - In August 2015 hackers calling themselves The Impact Team published almost 30 gigabytes of files including the names and credit card data of people who had signed up with Ashley Madison, a website facilitating extra-marital affairs.
Charlie Rose Accused of Sexual Misconduct by Eight Women
Both King and O'Donnell applauded the courage the women must have had to take steps to speak up about what happened to them. She said she told Yvette Vega, Rose's executive producer since his interview show was created in 1991, about the calls.
Race to Dubai glory for Fleetwood
Ireland's Shane Lowry (63) and Thailand's Kiradech Aphibarnrat were tied for second at 18 under 270. "Fast forward to here for me, it's been incredible to play and to enjoy my golf this year".
AC/DC Co-Founder Malcolm Young Dies At 64
Malcolm left AC/DC in 2014 after the band said he had been struggling with an undisclosed ailment, later revealed to be dementia. The experience was "very odd for him", Angus told the magazine, "but he was always a confident guy, and we made it work".
Shaun Marsh could miss first Ashes Test
Australia are sweating on the fitness of another key batsman, with Shaun Marsh the latest injury concern on the eve of the Ashes. The 2017-18 Ashes series will be played at five venues across Australia between November 23, 2017 and January 8, 2018.