---
title: "Uber service-provider account data incident"
description: "Uber confirmed personal-data access through an unnamed provider’s compromised internal credentials in October 2026."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-13"
canonical_url: "https://www.ally.security/incidents/uber-service-provider-account-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/uber-service-provider-account-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/uber-service-provider-account-data-incident-2026/stix.json"
---

# Uber service-provider account data incident

Uber confirmed personal-data access through an unnamed provider’s compromised internal credentials in October 2026.

Last modified Nov 13, 2026 · 1 source

## Summary

- **Environment:** Account hosted by an unnamed service provider
- **Operational impact:** Uber severed connections with the provider
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Uber](https://www.uber.com/) learned October 9, 2026 that a service provider’s internal credentials had been compromised and used to access Uber’s account. Uber confirmed access to its connected data October 13. [1](#source-1)

## Impact

The [November 10 notification](https://oag.ca.gov/system/files/Multistate%20Template%20-%20Final.pdf) says notified individuals’ personal information was accessed. It leaves the specific data fields blank and does not give a total. [1](#source-1)

## Timeline

### October 9, 2026 — Provider alerts Uber

Uber severed data connections and began investigating. [1](#source-1)

### October 13, 2026 — Uber data access confirmed

The investigation established access to connected data. [1](#source-1)

### November 10, 2026 — Notification letter issued

Uber offered credit monitoring and fraud assistance. [1](#source-1)

### November 13, 2026 — Briefing updated

This briefing was last reviewed and updated on November 13, 2026.

## Threat Group & Attack Vector

The provider and method used to steal its credentials remain unidentified in the notice. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- [T1078 — Valid Accounts](https://attack.mitre.org/techniques/T1078/): the actor used compromised provider credentials to reach Uber’s account. [1](#source-1)

## Response

Uber disconnected the provider to prevent further access and investigated affected information. It reported no identified misuse as of the letter. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/uber-service-provider-account-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Uber service-provider account incident notification

official · Uber Technologies, Inc. · Nov 10, 2026

<https://oag.ca.gov/system/files/Multistate%20Template%20-%20Final.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Uber service-provider account data incident: Provider alerts Uber; connections severed
2. **Occurred At · 100% confidence · current**  
   Provider alerts Uber; connections severed: 2026-10-09
3. **Occurred At · 100% confidence · current**  
   Personal-data notices issued: 2026-11-10
4. **Used Attack Technique · 100% confidence · current**  
   Uber service-provider account data incident: https://attack.mitre.org/techniques/T1078/
5. **Affected Organization · 100% confidence · current**  
   Uber service-provider account data incident: Uber
6. **Resulted In · 100% confidence · current**  
   Uber service-provider account data incident: A service provider told Uber October 9 that an unauthorized third party had compromised the provider’s internal credentials and used them to access Uber’s account with that provider.
7. **Resulted In · 100% confidence · current**  
   Uber service-provider account data incident: Personal-data notices issued
8. **Discovered At · 100% confidence · current**  
   Uber service-provider account data incident: 2026-10-09
9. **Disclosed At · 100% confidence · current**  
   Uber service-provider account data incident: 2026-11-10
10. **Resulted In · 100% confidence · current**  
   Uber service-provider account data incident: Uber severed its data connections with the provider immediately after notification and investigated the incident.
11. **Resulted In · 100% confidence · current**  
   Uber service-provider account data incident: Uber data access confirmed
12. **Occurred At · 100% confidence · current**  
   Uber data access confirmed: 2026-10-13
13. **Resulted In · 100% confidence · current**  
   Uber service-provider account data incident: Uber determined October 13 that the actor accessed Uber data connected to the provider, including the notified individuals’ personal information. The public template leaves data categories unspecified and gives no total.
14. **Resulted In · 100% confidence · current**  
   Uber service-provider account data incident: Uber offered credit monitoring and fraud assistance and said it had not identified data misuse as of its November 10 letter. The template does not state a monitoring duration.

</details>