By the time the ambulance arrived, Brandy Littrell said she didn’t know how many times she’d been shot. As the paramedics carefully cut off her clothes, they counted—seven. She said she was hit in her leg, stomach, arm, breast, neck, and back. The impact of the bullets broke her shoulder and bruised a lung.

Littrell was driving for Lyft when she picked up a passenger around noon on Nov. 2, 2021, in a tree-laden suburb of Jackson, Miss. Shortly after the ride began, the passenger, whose name in the app was “dtown,” held a gun to Littrell’s head and told her to get into the back seat, she said. He drove to a forested area, forced her to walk into the woods, told her to get on her knees, and repeatedly shot her. Then, she said, he took off with her black Dodge Journey.

“I felt blood dripping down my neck and my face, and it was dripping on my glasses. I thought, ‘This is how I’m fixing to die,’ ” said Littrell, who was 36 at the time. “I lay there for a few seconds and realized I wasn’t dead, and I realized I got to get out of there.”

Littrell was working for Lyft, but she is just one of hundreds of gig workers—Lyft and Uber drivers, and DoorDash, Instacart, Grubhub, and Amazon Flex couriers—who’ve been carjacked in the U.S. over the last five years. In many of these cases, the would-be assailants used the company apps themselves to lure unsuspecting drivers. 

The Markup has tracked a total of 361 ride-hail and delivery drivers who’ve been victims of carjackings or attempted carjackings since 2017. We initially reported 124 such incidents last July and now have tracked 237 more.

Many of the drivers were immigrants, women, or elderly. A total of 28 workers were killed, and dozens more were severely or permanently injured. Ride-hail drivers were most frequently victims of the carjackings, with 121 Uber drivers and 101 Lyft drivers targeted in these incidents over the last five years.

Newly revealed data from Uber, however, indicates that the numbers could be far higher.

Uber has produced at least 24,000 “safety incident reports” that involved physical assaults perpetrated against its drivers by passengers from 2017 to 2020, according to a plaintiff’s motion filed on July 11 in a federal wrongful death lawsuit against the company. Uber spokesperson Navideh Forghani confirmed to The Markup that the company provided the 24,000 incident reports in the case. Those safety incident reports are among tens of thousands of pages of discovery in the suit, which are under seal.

In a response to the motion, Uber’s lawyers confirmed the company has provided more than 70,000 pages of safety incident reports in the suit, which “contain highly sensitive and personal information regarding alleged assaults and threats of assaults.”

It’s unclear how many of the 24,000 incidents were carjackings; the details are confidential. But this is the first time the number of alleged assaults against Uber drivers has been made public—and it provides a behind-the-scenes glimpse into the high rate of these attacks.

Uber is being sued by the family of a driver who was fatally stabbed by two passengers during an attempted carjacking in Issaquah, Wash., in December 2020. The driver, Cherno Ceesay, was a 28-year-old immigrant from Gambia. The case is pending trial later this year in U.S. District Court for the Western District of Washington, at Seattle.

“While we are unable to comment on pending litigation, we can’t imagine the pain and loss Mr. Ceesay’s family feels,” said Uber’s Forghani. She added that for carjackings of Uber drivers overall, “​​We want to make sure it is clear how seriously we take this issue and its impact on drivers and their families.”

Lyft spokesperson Gabriela Condarco-Quesada said, “Safety is fundamental to Lyft.” Regarding the carjacking of Littrell, she said, “The incident described was horrific and our hearts go out to Ms. Littrell and her loved ones.”

Uber and Lyft drivers and gig workers for other companies have little say in how the apps assign them passengers or delivery jobs, and they typically don’t know the ride’s destination until they accept the fare. If they decline rides, the companies can issue penalties. Additionally, the app platforms tend to use bonuses and incentives urging drivers to work long hours and often into the night—making them especially vulnerable to crimes like carjackings.

“The less voice and self-determination you provide to workers, the more tenuous the situation that workers are placed in,” said Michael Maffie, an assistant professor at Cornell who focuses on gig work.

Ceesay frequently worked long hours because he was saving money to start his own business, according to his family’s lawsuit. It was around 9 p.m. on a Sunday when he got the ding on his Uber app to pick up “Stephanie Tylor.” Almost immediately after the two passengers got into his car, they attacked him with a knife—stabbing him in the head and neck.

Ceesay probably became unconscious within seconds and then died shortly after, said the medical examiner in a probable cause statement that The Markup obtained from the Issaquah Police Department.

Police departments across the country have reported an overall surge in carjackings over the past couple of years. But some departments, like those in Chicago, Minneapolis, and Oakland, say gig workers have been specifically targeted. Last fall, for instance, the Minneapolis Police Department issued a warning that reported nearly 50 carjackings of Uber and Lyft drivers over a two-month period.

“We’re very concerned about the safety of these drivers,” Officer Garrett Parten, a spokesperson for the Minneapolis Police Department, told The Markup. “This is tough, this is people’s livelihoods.”

More than 198 of the carjackings and attempted carjackings we tracked have taken place since The Markup’s first report last July, with 92 so far in 2022, 200 in 2021, and 55 in 2020. While ride-hail drivers were most frequently targeted, one Instacart, two Grubhub, two Amazon Flex, and 10 DoorDash couriers were also victims, according to local news and police reports. Along with Minneapolis and Chicago, other cities with high rates of gig worker carjackings include Atlanta, Cleveland, St. Louis, and Washington, D.C.

Our data isn’t comprehensive, however. Most police departments don’t gather statistics on carjackings specifically against gig workers, and the gig companies have repeatedly declined to provide their own data on carjackings. The Markup compiled its database through police reports and local news articles that cite police reports, and by conducting interviews with drivers, family members, and lawyers representing drivers (or their families) who were victims of carjackings.

DoorDash spokesperson Julian Crowley said that anytime a DoorDash worker “is the victim of a crime it is a tragedy and we do everything we can to support law enforcement to hold the perpetrators accountable.” He added that the “overwhelming majority” of deliveries don’t have safety-related incidents. 

Crowley said eight of the DoorDash incidents tracked by The Markup don’t show “any evidence” that the company’s workers were involved or that they occurred on its platform. The  incidents referred to by Crowley were all reported in local news outlets citing police as saying a DoorDash worker was a carjacking victim. 

Similarly, Grubhub spokesperson Liza Dee said one of the Grubhub couriers who was killed wasn’t actively working on the platform when the crime took place. She added, “Still, our senior leadership met with that courier’s family and directly provided financial support in the wake of a senseless crime.” 

Amazon spokesperson Alisa Carroll said the company is committed to the safety of drivers and “we proactively communicate that drivers should never make a delivery if they feel unsafe.” She added that when incidents do occur, “we evaluate the incident and take action to help prevent it from happening again.”

Instacart did not respond to a request for comment.

Both Uber and Lyft have released public safety reports—but those reports only include specific data on motor vehicle fatalities, fatal physical assaults, and sexual assaults (the reports include incidents to both passengers and drivers). The public reports don’t include any other type of assault or attempted assault, such as nonfatal shootings, robberies, or carjackings.

Uber’s 24,000 safety incident reports, however, are the company’s internal count of all other alleged physical assaults that aren’t included in the company’s public safety reports. And those 24,000 incidents specifically detail alleged physical assaults or threats of assaults on drivers by passengers. (It’s unclear if fatal physical assaults are also included within these incidents.) 

In the plaintiff’s motion in Ceesay’s case, attorney Corrie Yackulic wrote that Uber acknowledged in a still-sealed document that there was a “surge in carjackings against Uber Drivers,” which began before the end of 2020. She added that the sealed document shows the company’s system for recording safety incident reports “was designed so as to seriously undercount the incidence of carjackings, obscuring from Uber’s ‘data analytics’ system the magnitude of the problem.”

Uber’s Forghani didn’t respond to questions about these claims.

Last month, a group of U.S. senators sent letters to Uber, Lyft, DoorDash, Instacart, and Grubhub asking them for data on worker safety incidents over the past five years. In responses to the senators, DoorDash, Instacart, and Grubhub didn’t provide any data, and Uber and Lyft both referred to their previous safety reports, the most recent data of which was from 2020.

Under Lyft’s current guidelines for its safety reports, it wouldn’t have included the attack on Littrell. 

Both Littrell and Ceesay were matched with their assailants through the ride-hail apps. According to the data collected by The Markup, the majority of the ride-hail carjackings (at least 182, or 56 percent) reportedly took place after drivers were paired with their would-be assailants through the companies’ apps.

In both Littrell’s and Ceesay’s cases, the suspects used fake names ( “dtown” and “Stephanie Tylor” were bogus) and other false information on the apps. While drivers must go through background checks, neither Uber nor Lyft require passengers to use an ID to open an account. The companies make it fairly simple for riders to create fake accounts with fake names and, oftentimes, to use untraceable payment methods, like gift cards. 

The two people who carjacked Ceesay created an Uber account just 13 minutes before they requested the ride, according to the Issaquah Police Department’s probable cause statement. The suspects used an unverified form of payment and the false “Stephanie Tylor” name to open the account.

“In a dark section of Renton Issaquah Road, they created an Uber account with a fake name and an email they both disavow for the purpose of hailing a stranger, Cherno Ceesay to their location,” senior deputy prosecutor Adrienne McCoy wrote in the charging papers. “When he arrived, they stabbed him to death in the course of trying to steal his car.”

When he arrived, they stabbed him to death in the course of trying to steal his car.

Charging papers in the death of Uber driver Cherno Ceesay

In both Ceesay’s and Littrell’s cases, the suspects were found and charged.

Uber has since said it no longer allows the use of a prepaid card, gift card, or Venmo to open a new account in the U.S. without also uploading a valid ID. And Lyft said that in 10 U.S. cities, it has also stopped allowing new passenger accounts to use untraceable payment methods without an ID. If a non-anonymous payment method is used to open an account, a valid ID isn’t required.

“Based on discussions with law enforcement and experts in this field, we know that additional verification requirements may deter potential malicious actors, but it is not a complete fail-safe,” Uber’s Forghani said. The ID requirement “was a direct response to the increased number of carjackings in communities across the U.S.”

“Drivers can always cancel a trip if they ever feel unsafe,” Forghani added, saying that Uber has included several safety features, such as an emergency button, to its app. Lyft’s Condarco-Quesada said Lyft too has added various similar safety features to its app.

Both Forghani and Condarco-Quesada said Uber and Lyft work with local police on carjacking task forces in several cities, including Chicago, Minneapolis, and Washington, D.C., and that the companies assist police in their investigations.

Neither company responded to questions about why they don’t require passengers to always use a valid ID to open an account. They also didn’t say if they verify riders’ email addresses, phone numbers, and names.

All of the gig companies we tracked consider their workers independent contractors, so they don’t have sick leave, workers’ compensation, or medical insurance through the companies. When something goes wrong on the job, workers say, they’re often left to take care of medical bills and destroyed or stolen vehicles on their own. 

Many drivers, like Littrell, started GoFundMe campaigns to help pay for hospital bills and car replacement or repairs. Families of killed drivers have done the same for funeral expenses. 

After Littrell crawled out of the woods that November day, she made it to a nearby apartment complex, and a woman there called 911 for help.

“I could tell I was quickly fading,” Littrell said. “I tell her, ‘If I don’t make it, please tell [my family] I love them.’ ”

Littrell spent a week in the hospital. At home, she said, she first needed a wheelchair and then a walker. Lyft paid for some of her medical expenses, she said, but she had to sign a nondisclosure agreement specifying she could not reveal the amount she received.

Condarco-Quesada confirmed Lyft provided Littrell with financial assistance but didn’t respond to questions about the nondisclosure agreement.

Now, nearly nine months later, Littrell said she’s been focusing on recovery and slowly getting back to work. She no longer needs the walker but said she still deals with the emotional and physical reminders of the carjacking every day.

She drives for Uber and occasionally for Lyft but said it makes her nervous. Both companies could do more to improve safety for drivers, she said, suggesting they enforce the rule that only people 18 years and older can sign up for the app and require riders to use a valid ID to avoid fake accounts.

“The guy that shot me was 17,” Littrell said. “He wasn’t even old enough to use Lyft’s platform.”