Uber notifies drivers after vendor breach exposed driver's license data
In brief
- Hackers used an outside vendor's stolen credentials to access Uber driver data.
- Access began as early as October 7, 2026, according to Uber's filings.
- South Carolina, Massachusetts and Rhode Island reported 3,430, 2,567 and 1,873 affected residents, respectively.
- Uber hasn't disclosed a national count of affected drivers.
- Uber is offering free TransUnion credit monitoring and says it has seen no known misuse.
How the breach unfolded
According to Uber's state breach-notification filings, as reported by Crypto Briefing, unauthorized access began as early as October 7, 2026. The vendor told Uber on October 9 that it had been compromised. Hackers had broken into the provider's systems and taken internal credentials, and they then used those credentials to get into Uber's data.
Uber's internal investigation confirmed the unauthorized access on October 13. Drivers started getting notices on November 10.
State counts, but no national total
The filings break out affected residents state by state. South Carolina notified 3,430 residents, Massachusetts reported 2,567 and Rhode Island reported 1,873, according to the filings cited by Crypto Briefing. Drivers in other states were affected too, and Uber has filed notices in California as well.
So how many drivers were hit in total?
Uber hasn't said. A complete national figure hasn't been disclosed, and much of the detail on exactly which data fields were exposed is redacted in the filings. The records do confirm that driver's license numbers were part of the stolen data.
Uber's response and the vendor problem
Uber says it's cut ties with the provider, which hasn't been publicly named. The company is offering affected drivers free credit monitoring and fraud assistance through TransUnion, according to Crypto Briefing's report, and it says it has seen no known misuse of the stolen information so far.
The route the attackers took is what stands out. Crypto Briefing compared the incident with the IDScan.net exposure earlier in 2026, which the outlet put at about 153 million driver's license scans across the US and Canada. In that case a scanning service's own records were exposed directly. Uber's problem came through a third-party supply chain instead (a vendor's stolen credentials opened the door to Uber's data).
That's the part security teams can't fix by locking down their own systems alone.
Frequently asked questions
How many Uber drivers were affected by the vendor breach?
Uber hasn't disclosed a national total. State filings show 3,430 affected residents in South Carolina, 2,567 in Massachusetts and 1,873 in Rhode Island, and Uber also filed notices in California. Drivers in other states were affected as well.
How did hackers get into Uber driver data?
According to Uber's filings, hackers broke into the systems of one of Uber's outside tech providers and took internal credentials. Those stolen credentials were then used to access Uber's data. The vendor told Uber it had been compromised on October 9, 2026.
What is Uber offering drivers affected by the breach?
Uber is offering affected drivers free credit monitoring and fraud assistance through a partnership with TransUnion. The company says it has seen no known misuse of the stolen information and has cut ties with the vendor.
