Uber confirms vendor breach exposed thousands of drivers’ licenses

Uber is sending breach notices to thousands of its drivers. Their personal details and driver’s license information were stolen in October, through one of the company’s outside tech providers rather than Uber itself.

The disclosure comes through filings with state attorneys general, California among them.

How the breach unfolded

According to Uber’s filings, the provider told the ride-hail company on October 9 that it had been compromised. Hackers had broken into the vendor’s systems and taken internal credentials.

Those stolen credentials were then used to get into Uber’s data.

The timeline in the regulatory records runs like this:

October 7, 2026: Unauthorized access began as early as this date.

October 9, 2026: The provider alerted Uber.

October 13, 2026: Uber’s internal investigation confirmed that data had been accessed without authorization.

November 10, 2026: Uber began notifying affected drivers.

The vendor has not been publicly named. Uber says it has cut ties with the provider.

Who was hit, and with what

State-level filings give the clearest picture of scale. In South Carolina, 3,430 residents were notified that their data had been compromised.

Massachusetts reported 2,567 affected residents. Rhode Island reported 1,873.

Those are only the states where counts have surfaced so far. Drivers in other states were also affected, and Uber has filed notices in California as well. A complete national figure has not been disclosed.

Much of the detail about exactly which fields were exposed remains redacted in the filings. The records do confirm that driver’s license numbers were part of the stolen data.

To soften the blow, Uber is offering affected drivers free credit monitoring and fraud assistance through a partnership with TransUnion. The company says it has seen no known misuse of the stolen information so far.

A bad year for license data

Uber’s incident lands in a year that has not been kind to driver’s license records. Earlier in 2026, the IDScan.net exposure involved approximately 153 million scans of driver’s licenses across the US and Canada.

The two cases came through different routes. IDScan.net was a direct exposure of a scanning service’s records, while Uber’s problem traveled through a third-party supply chain.

What this means for Uber and its drivers

For drivers, the practical steps are straightforward. Take Uber up on the TransUnion monitoring, watch credit reports, and be skeptical of unexpected messages that reference license details.

Drivers occupy an awkward spot here. They are independent contractors who had to hand over license data to work on the platform. That data then passed to a provider they likely never heard of, and it leaked from there.

Key things to watch next: whether additional states publish their affected counts, whether the vendor is eventually named, and whether any of the stolen license data surfaces in fraud cases.