Uber data breach letter: a service provider's stolen credentials opened Uber data in October 2026

Date	Event
October 7, 2026	Date of breach on the California record
October 9, 2026	The service provider tells Uber its credentials were compromised
October 13, 2026	Uber determines its data connected to the provider was accessed
November 10, 2026	Letters dated; notice posted by the California attorney general
November 11, 2026	Massachusetts records the report (2,567 residents)
November 12, 2026	Vermont records the report (1,071 residents)

What happened in the Uber data breach?

According to the letter, the intrusion started at the service provider, not at Uber. The provider's own internal credentials were compromised, and the intruder used them to log in to the account Uber holds with that provider. Once told, Uber says it cut its data connections to the provider and opened an investigation. Uber is writing to people whose personal information its investigation found among the data accessed. The letter does not say which Uber business the data came from (rides, delivery or driver accounts), what the provider does for Uber, or whether the intruder downloaded files. This is the same pattern as other vendor and cloud-tenant breaches in the log: a third party's access becomes the way into the client's data. Why you got a breach letter from a company you never dealt with covers the reverse case.

What information was exposed in the Uber breach?

The filed letter is a template: the list of data is a placeholder filled in for each person. The state records fill part of the gap. Vermont lists government ID numbers. Massachusetts marks driver's licenses as breached, and not Social Security numbers, medical records, financial accounts or card numbers. Security Today reported on November 13, citing Reuters, that the compromised records included U.S. driver's license information. Uber says it has not identified any misuse of the data so far. Your own letter lists the items that apply to you.

How many people were affected by the Uber breach?

No national total has been published. The counts on file so far are state counts:

State	Residents affected	Source
Massachusetts	2,567	Massachusetts OCABR 2026 report
Rhode Island	about 1,873	Uber's letter
Vermont	1,071	Vermont attorney general

Vermont's attorney general logged Uber's report on November 12, 2026: 1,071 Vermont residents, with government ID numbers as the category breached. The letter itself gives the Rhode Island figure. South Carolina's consumer affairs department has posted the same letter, without a count in the letter. Security Today lists residents of California, the District of Columbia, Maryland, New York, North Carolina and Pennsylvania among those affected. The guide to how breach counts arrive explains why the first numbers are often per state.

What is Uber offering people who got the letter?

Free credit monitoring and fraud assistance from Cyberscout, a TransUnion company. You enroll at mytrueidentity.com with the activation code printed on your letter. The deadline is 90 days from the date of the letter. For letters dated November 10, 2026, that is February 8, 2027. The template leaves the length of the monitoring blank, so it is set per letter. Pennsylvania residents who are not eligible for a free credit report can have Uber pay for one report from one bureau. Questions go to 1-866-317-7961, 8:00 a.m. to 8:00 p.m. Eastern, Monday through Friday. Credit monitoring offers in breach letters compares this offer with others.

Is the Uber letter real?

The letter Uber filed with the California attorney general comes from "Uber Technologies, Inc. c/o Cyberscout" at P.O. Box 3826, Suwanee, GA 30024. Enrollment runs through mytrueidentity.com. A letter that matches those details and the phone number above matches the filed template. The guide to reading a California AG breach notice shows how to compare a letter with the filed copy.