Official notice confirms Uber data breach at service provider, authorities notified in November
Key Facts
California’s attorney general’s office listed Uber Technologies in its data breach notices, recording October 7, 2026, as the incident date and November 10 as the reporting date. Uber said an unauthorized party used compromised internal credentials at a service provider to access company data associated with it. The notice confirms unauthorized access to Uber data, but does not specify that the data involved U.S. drivers’ licenses. It also did not name the personal information categories involved, leaving that field in the notice form as a placeholder that varies by recipient. This places the incident in the context of a data breach through a service provider, without specifying the types of information covered by this notice.
Uber said the service provider notified it on October 9 that an unauthorized party had compromised its internal credentials. It added that its investigation concluded on October 13 that the party had used those credentials to access company information connected to the provider. The notice stated: "On October 13, 2026, our investigation concluded that the unauthorized party used the compromised credentials to access Uber data associated with the service provider." In this sequence, the provider’s notification to the company preceded the report recorded by the California office on November 10. Uber’s notice did not describe the incident as targeting driver document databases, nor did it identify the individual data categories affected.
The company said it launched an investigation and cut data connections with the service provider to prevent any further unauthorized access to Uber data. The notice states that, to date, the company has not identified any misuse of the data. It also said it is offering credit monitoring and fraud assistance at no charge to the specified notice recipients. A letter dated November 10 said recipients must enroll in the services within 90 days of its date. This means access to the announced assistance is tied to the enrollment deadline in the letter and limited to those who received the specific notice.
An attachment to Uber’s notice said the incident affected approximately 1,873 Rhode Island residents, while South Carolina’s Department of Consumer Affairs recorded 3,430 affected residents and listed November 10, 2026, as the reporting date. These figures reflect the scope of the notices recorded in the two states and do not, by themselves, identify the types of data involved for each recipient. In Rhode Island, the law requires notification to the attorney general’s office within 45 days if a data breach exposes personal information belonging to more than 500 state residents. This regulatory framework provides context for notifying authorities, while the company notice gives separate counts of affected residents in the two states. The details of individual data remain unnamed in Uber’s official form.
In its annual filing, Uber said a 2016 breach affected data belonging to approximately 57 million drivers and riders worldwide and included the driver’s license numbers of approximately 600,000 drivers. The company also said it experienced a cybersecurity incident in September 2022 that allowed an attacker to access some of its internal systems, tools and data. These past incidents provide context for the company’s history of security incidents, but do not establish that driver’s license data was among the information connected to the current incident. Uber warned in its filing that its partners’ and service providers’ systems may contain confidential information or sensitive personal data. It added that providers’ failure to prevent breaches could have a similar adverse effect on the company.
Uber shares closed at $69.12 in the November 12, 2026, session, according to EL7 data, before the notice details reported in this article were published. The documented data available here do not include the session high and low, and the closing record does not link the share move to the incident. The available market context is therefore limited to the closing price that day. The notice records October 7 as the incident date and November 10 as the date the California office was notified. The notice did not identify the personal information categories covered by the incident.