Uber Technologies, Inc. has notified individuals of a security incident tied to a third-party service provider and filed a sample notice with the California Attorney General. This page explains what the notice says, what it leaves out and what affected people can do now.
The details below come from Uber’s own multistate notice template and a state listing, and they may change if more information is released.
Uber Technologies, Inc.’s Data Breach Investigation
Uber Technologies, Inc. operates the Uber ride-hailing app and related delivery services, and it works with many outside service providers that connect to its data. According to the notice it filed with state regulators, the incident began not on Uber’s own systems but at one of those providers.
The notice says that on October 9, 2026, a service provider told Uber that an unauthorized third party had compromised the provider’s internal credentials. The third party then used those credentials to access Uber’s account with the service provider. The California Attorney General’s listing gives October 7, 2026 as the date of the breach, which suggests the unauthorized activity started a couple of days before Uber was told.
Uber says that after it was notified, it immediately severed its data connections with the service provider and opened an investigation. On October 13, 2026, that investigation determined that the unauthorized party had used the compromised credentials to access Uber data connected to the provider. The notice says people are being contacted because the investigation concluded that their personal information was among the information accessed.
The notice template is dated November 10, 2026, and the incident appears in the California listing with a reported date of November 10, 2026. A short list of state regulators is addressed in an addendum, covering the District of Columbia, Maryland, North Carolina, New York and Rhode Island. The Rhode Island paragraph states that approximately 1,873 Rhode Island residents were affected. That is the only count in the filing, and it applies to a single state.
No nationwide total has been published. Because the notice is a multistate template used for recipients in many places, the Rhode Island figure should not be read as the size of the whole incident, and this page does not estimate a total. Counts for other states may appear in separate regulator filings.
The sample notice does not name the service provider, and it does not say what kind of service the provider performs for Uber. It also does not say how the third party obtained the provider’s credentials, how long the unauthorized access lasted or whether any data was copied outside the provider’s systems. Those details matter for understanding the risk, and they have not been made public.
The most important gap is the type of information involved. In the version filed with California, the sentence listing the personal information that was involved contains an unfilled merge-field placeholder in place of the actual data elements, so the specific categories have not been publicly disclosed. The letter you receive should name the data elements that apply to you. Until you see it, treat any account, contact or payment information you gave Uber as potentially at risk.
Uber says it has not identified any misuse of the data to date. It is offering affected people credit monitoring and fraud assistance at no charge through Cyberscout, a TransUnion company. The sample leaves the length of the monitoring as a blank placeholder, so check your own letter for the real figure. Enrollment requires an activation code from the letter, and the notice says you must enroll within 90 days of the letter’s date.
Incidents that start at a vendor are a common and growing source of consumer data breaches. A company can invest heavily in its own security and still be exposed when a partner’s login credentials are stolen. For consumers, the practical effect is the same as any other breach: your information may be in someone else’s hands, and you may not learn of it until a notice arrives. If you receive a notice from Uber, keep it and act on the steps below.
When Did This Breach Occur?
According to the California Attorney General’s listing, the breach occurred on October 7, 2026. Uber’s notice says a service provider alerted it on October 9, 2026, and that its investigation determined on October 13, 2026 that Uber data connected to the provider had been accessed. The notice is dated November 10, 2026, and the incident was reported to California on the same date. Uber has not said how long the unauthorized access continued.
What Information Was Breached?
The notice says personal information about the recipient was involved, but the specific data elements are left as an unfilled placeholder in the version filed with California. The categories of information have therefore not been publicly disclosed. Your own letter should list what applies to you. Until you read it, review your Uber account, linked payment methods and any other account that shares the same email address or password.
What You Can Do
If you received a notice related to Uber Technologies, Inc. or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the free credit monitoring and fraud assistance with the activation code in your notice within 90 days of the letter date, and review your Uber account and linked payment methods for activity you did not authorize.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Uber Technologies, Inc.
Attorneys are looking into the data breach reported by Uber Technologies, Inc. and want to hear from people who received a notice. A lawsuit has not been confirmed, and whether you can seek compensation depends on what the company ultimately confirms about the incident. If you received a notice or believe your information was exposed, an attorney can explain whether you may be able to join a class action lawsuit.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
