Uber Driver Data Breach Investigation

Uber’s November 10 notice says a provider alerted it on October 9, 2026 about compromised internal credentials used to access Uber’s account. Uber disconnected the provider and investigated. On October 13, it determined that Uber data had been accessed.

California’s filing lists October 7 as a breach date. These dates describe different stages and do not establish the complete access period. This investigation concerns the October 2026 provider incident and the resulting November notices.

The credentials described in the notice belonged to the provider. That description does not establish that drivers’ Uber passwords were stolen.

The Wall Street Journal also has coverage of Uber’s third-party data breach, linked below.

We invite inquiries from people who:

• Currently drive for Uber, previously drove for Uber, or no longer have access to a driver account, and received an incident notice or have a related concern.
• Were told that driver’s license or other personal information provided to Uber may be involved.
• Experienced suspected identity misuse, unfamiliar accounts, or suspicious messages using private details, with information suggesting a connection to this incident.
• Spent time or money responding, replacing documents, addressing suspected fraud, or seeking assistance.

Uber Eats couriers and other notified individuals may also inquire; their inclusion should be evaluated from the notice and available facts. We do not assume every courier or rider was affected.

You do not need a notice or known financial loss to request a review. Describe what happened and when. We will evaluate individual involvement, any connection to suspected misuse or expenses, and possible claims.

We are examining what driver information was shared with outside providers, the safeguards and retention practices applied, the timing and content of notices, and consequences for affected people. These are questions under review, not findings that Uber or a provider violated a legal duty.

Keep your original notice, envelope, relevant support correspondence, suspicious messages, and records of response time, expenses, or suspected misuse. Describe incident-related costs separately from ordinary driving expenses, and preserve any credits, refunds, or reimbursements. Keep only records you are authorized to access.

Start with a brief description. Do not send driver’s license images or numbers, Social Security numbers, tax documents, full account details, passwords, verification codes, monitoring codes, or passenger records in an initial inquiry. Do not seek, download, or share allegedly stolen records.