Incident BriefingsUber service-provider account data incident

Uber service-provider account data incident

Uber confirmed personal-data access through an unnamed provider’s compromised internal credentials in October 2026.

Last modified

Summary

  • Environment: Account hosted by an unnamed service provider
  • Operational impact: Uber severed connections with the provider
  • Financial impact: No confirmed incident cost quantified
  • Record status: Developing record. Reviewed November 13, 2026; updated as evidence emerges.

What happened

Uber learned October 9, 2026 that a service provider’s internal credentials had been compromised and used to access Uber’s account. Uber confirmed access to its connected data October 13. [1]

Impact

The November 10 notification says notified individuals’ personal information was accessed. It leaves the specific data fields blank and does not give a total. [1]

Timeline

  1. Provider alerts Uber

    Uber severed data connections and began investigating.

    [1]

  2. Uber data access confirmed

    The investigation established access to connected data.

    [1]

  3. Notification letter issued

    Uber offered credit monitoring and fraud assistance.

    [1]

  4. Briefing updated

    This briefing was last reviewed and updated on November 13, 2026.

Threat Group & Attack Vector

The provider and method used to steal its credentials remain unidentified in the notice. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

Response

Uber disconnected the provider to prevent further access and investigated affected information. It reported no identified misuse as of the letter. [1]