Uber
Disclosed Nov 21, 20178 years ago57,000,000 affectedSettled
2016 breach of 57M riders and drivers concealed; USD 148M states settlement and EU fines
In October 2016 hackers used credentials found in Uber's private GitHub repositories to reach its AWS storage and download data on 57 million riders and drivers, including about 600,000 US driver licence numbers; Uber paid them USD 100,000 to stay quiet and disclosed it a year later. It settled with all 50 states and DC for USD 148M, expanded its FTC order, and was fined by the UK ICO (GBP 385,000), Dutch DPA (EUR 600,000) and CNIL (EUR 400,000).
What is known
| People affected | 57,000,000 (as reported by the organization) |
|---|---|
| Disclosed | Nov 21, 2017 |
| Discovered | Nov 2016 |
| Attack | Hacking |
| Data exposed | Names, Emails, Phone numbers, Government IDs |
| Sector | Transport · US |
| Status | Settled |
| Lawsuit or fine | USD 148M 50-state AG settlement (Sept 2018); expanded FTC order (2018); ICO GBP 385,000, Dutch DPA EUR 600,000, CNIL EUR 400,000 fines (about $150M) |
Sources
| Source | |
|---|---|
| Uber Technologies S-1 (April 2019)sec.gov · SEC filing | SEC filing |
| 2016 Data Security Incidentuber.com · The organization | The organization |
| NY AG: Record USD 148 Million settlement with Uber over 2016 data breachag.ny.gov · Regulator | Regulator |
| Uber (Wikipedia)en.wikipedia.org · News | News |
| Uber data breach from 2016 affected 57 million riders and driverstechcrunch.com · News | News |
| Uber to pay $148 million in data breach settlementtechcrunch.com · News | News |
| Uber's bill for 2016 breach and cover-up rises by $1M+ on EU finestechcrunch.com · News | News |
| French data protection watchdog fines Uber $460,000 for data breachtechcrunch.com · News | News |
| Uber Agrees to Expanded Settlement with FTC Related to Privacy, Security Claimsftc.gov · Regulator | Regulator |
Notices filed
Other breaches at Uber
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Lapsus$-linked hacker breaches Uber internal systems via contractor accountSep 16, 20224 years agoHacking | Sep 16, 20224 years ago | Hacking | Transport | Confirmed | Unknown |
History of this record
- 2026-09-25 · fine_usd: 148000000 to 149600000 · seed source
- 2026-09-25 · lawsuit: $148M settlement with all 50 state attorneys general and DC (2018) to USD 148M 50-state AG settlement (Sept 2018); expanded FTC order (2018); ICO GBP 385,000, Dutch DPA EUR 600,000, CNIL EUR 400,000 fines · seed source
- 2026-09-25 · summary: Uber's CEO disclosed that in late 2016 outsiders downloaded files with personal data of 57 million users worldwide, including names and driver's license numbers of about 600,000 US drivers; the company had paid the attackers and not reporte to In October 2016 hackers used credentials found in Uber's private GitHub repositories to reach its AWS storage and download data on 57 million riders and drivers, including about 600,000 US driver licence numbers; Uber paid them USD 100,000 · seed source
- 2026-09-25 · title: Uber reveals concealed 2016 breach of 57 million riders and drivers to 2016 breach of 57M riders and drivers concealed; USD 148M states settlement and EU fines · seed source
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.