Uber $148 Million Data Breach Settlement: Where the Money Actually Went

Who qualifies

• There was never a nationwide claim form for the 2016 Uber breach. The $148 million went to state governments, so for most people there was nothing to apply for.
• The one direct-payment route was in Texas: eligible Uber drivers there received a $100 payment funded from the state's share of more than $6.4 million.
• Texas eligibility was limited to drivers whose driver's license numbers were accessed during the 2016 breach — roughly 600,000 US drivers had licence data taken nationwide. Drivers who had since stopped driving for Uber remained eligible.
• Riders were not eligible for a payment anywhere. Rider data taken in the breach was names, email addresses and mobile phone numbers, and no state announced rider payments.
• Everyone else's claims went to individual arbitration rather than a class action, following the Central District of California's September 5, 2018 ruling enforcing Uber's arbitration clause. Individual arbitration remains theoretically available under the terms you agreed to, but there is no fund, no administrator and no deadline-driven claim process attached to it.

The breach Uber hid, and why almost nobody was paid

1. 1

   November 2016 — the breach, and the payoff

   In November 2016 hackers in the United States and Canada contacted Uber's security team to say they had downloaded personal information belonging to 57 million riders and drivers. Using an access key, the intruders pulled unencrypted files from Uber's cloud storage containing more than 25 million names and email addresses, 22 million names and mobile phone numbers, and 600,000 names paired with driver's license numbers. Uber paid the hackers $100,000 and obtained assurances that they had deleted the data.

2. 2

   The concealment — and why it was worse than the breach

   Uber did not disclose the incident until November 2017, a full year later. The delay is what made this a record enforcement matter: Uber was already under FTC investigation over its data security practices at the time, and it did not tell the FTC either. Affected drivers were not told that their driver's license information had been taken, which state attorneys general said deprived them of the chance to protect themselves from identity theft and fraud during the year of silence.

3. 3

   September 5, 2018 — the class actions are sent to arbitration

   About 14 lawsuits were consolidated as In re Uber Technologies, Inc., Data Security Breach Litigation, MDL No. 2:18-ml-02826, in the Central District of California. On September 5, 2018 the court granted Uber's motion to compel arbitration: riders and drivers had accepted an arbitration provision in Uber's terms when they registered. The plaintiffs argued the clause did not cover a data breach, that it was unconscionable, and that riders never received reasonable notice of the electronic terms. The court rejected each argument. This single ruling is why there is no Uber breach class action settlement — the claims left the class device entirely.

4. 4

   September 26, 2018 — the $148 million state settlement

   All 50 state attorneys general and the District of Columbia announced a $148 million agreement, the largest multistate data breach settlement at the time. It resolved the states' claims that Uber violated state breach notification laws by concealing the incident. The money was allocated among the states as civil recoveries. Uber also agreed to adopt strong data security policies, use multi-factor authentication, run a corporate integrity reporting program, protect user data held on third-party platforms, and obtain independent third-party security assessments.

5. 5

   Texas — the one place drivers were actually paid

   Texas received more than $6.4 million and Attorney General Ken Paxton said most of it would be returned to Uber drivers across the state, in the form of a $100 payment to each eligible driver. Eligible drivers were those whose driver's license numbers were accessed during the 2016 breach, and the state noted that drivers who had stopped driving for Uber were still eligible. A settlement administrator was appointed to notify and pay them. This is the detail most coverage omits, and it is the only direct consumer-facing payment the $148 million produced.

6. 6

   October 2018 — the FTC order, which contained no money

   The FTC had already been investigating Uber over a 2014 breach when the 2016 incident happened and went unreported. It renegotiated its settlement into an expanded order, given final approval in October 2018 under Docket No. C-4662 (File No. 152-3054). Uber must implement a comprehensive privacy program and, for 20 years, obtain biennial independent third-party assessments and submit them to the Commission; it can face civil penalties if it fails to notify the FTC of future incidents involving unauthorized access to rider or driver information. No consumer refunds were part of it — FTC orders sometimes carry redress and sometimes carry only obligations, and this one is the second kind.

7. 7

   October 2022 — a criminal conviction for the cover-up

   Joseph Sullivan, Uber's former chief security officer, was prosecuted in the Northern District of California and convicted by a federal jury in October 2022 of obstructing an FTC proceeding and misprision of a felony. Prosecutors showed he learned of the hack on November 14, 2016 — ten days after testifying to the FTC about Uber's security — told a subordinate they "can't let this get out," and arranged to pay the hackers under non-disclosure agreements that falsely stated no data had been taken. He was sentenced to three years' probation and a $50,000 fine. Uber itself entered a non-prosecution agreement with the Department of Justice.

8. 8

   September 30, 2022 — the MDL closes with no class fund

   The consolidated federal litigation was terminated on September 30, 2022. No class was certified for settlement, no notice was ever mailed to a class, and no fund was created. If you are searching for an Uber data breach claim form, this is the answer: one was never created, because the case never reached the stage that produces one.

9. 9

   What to do if your licence data was taken

   A driver's license number, unlike a card number, is not reissued easily, and it is used to open accounts and file fraudulent claims. A free security freeze at Equifax, Experian and TransUnion blocks new credit accounts and must be placed at each bureau separately. If your licence was misused, IdentityTheft.gov is the FTC's free service for an official identity theft report and a recovery plan. Neither is a settlement claim — they are the practical remedies that exist where a settlement did not.

Frequently asked questions

Sources and official records

Every figure and date on this page was taken from the primary records below — court dockets, agency releases, and the settlement administrator's own notices. Payout averages we describe as averages are calculated from the official totals, not reported per-person estimates.

• New York Attorney General — record $148 million settlement, breach scope, the $100,000 hacker payment, New York's $5.1 million share
• Texas Attorney General — Texas's $6.4 million share and the $100 payment to eligible Texas drivers whose licence numbers were accessed
• FTC — final approval of the expanded Uber order (Docket C-4662): comprehensive privacy program, 20 years of biennial assessments, no consumer redress
• DOJ (N.D. Cal.) — former Uber CSO Joseph Sullivan convicted of obstructing the FTC and misprision of a felony over the cover-up
• DOJ (N.D. Cal.) — Sullivan sentenced to three years' probation and a $50,000 fine
• CourtListener — In re Uber Technologies, Inc., Data Security Breach Litigation, MDL 2:18-ml-02826 (C.D. Cal.), terminated September 30 2022 with no class settlement