Uber data breach (2016): what happened and what to do
2 min read · Updated November 8, 2026
In 2016 attackers stole data on about 57 million Uber riders and drivers, including names, email addresses and phone numbers, and roughly 600,000 US driver’s license numbers. Uber paid the attackers and kept it quiet until November 2017. Change reused passwords and watch for phishing.
What happened
Uber said two outsiders accessed a private code repository, found cloud credentials and downloaded user data. The company paid the attackers 100,000 dollars to delete it and sign nondisclosure agreements, and did not tell regulators or affected people at the time.
New management disclosed the incident in November 2017. The company later reached a settlement with US states, and a former security chief was convicted in 2022 over the handling of the case.
What was exposed
- ✓Names, email addresses and mobile phone numbers of about 57 million riders and drivers.
- ✓Around 600,000 US drivers’ license numbers.
- ✓Uber said trip location history, card numbers and Social Security numbers were not taken.
Were you caught up in a major breach?
Old breaches keep circulating for years. Scan your email against known breach records for a one-time $1.99.
Why it still matters
The cover-up is why this breach is remembered. People went more than a year without knowing their details were out, and during that time they had no chance to be careful.
The exposed contact details are enough for targeted phishing or smishing that mentions a ride-hailing account, so treat unexpected messages about rides or payments with suspicion.
What to do
- ✓Check your email address to see whether it appears in known breach records.
- ✓Change any password you used on the affected service, and anywhere you reused it.
- ✓Turn on two-factor authentication, starting with email and financial accounts.
- ✓Be careful with unexpected messages that mention the service.
Frequently asked questions
Were Uber passwords stolen?+
Uber reported that the accessed data did not include passwords, trip history or card numbers.
Why was this breach controversial?+
Because the company paid the attackers and delayed disclosure for about a year instead of notifying affected people.
Should drivers do anything extra?+
Drivers whose license numbers were exposed should monitor for identity misuse and consider a fraud alert with credit bureaus.
Stop guessing. Check your email in seconds.
The Leakill scan looks for your email address in known breach records and delivers a detailed report: the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-time $1.99 payment, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.