The suit, filed Thursday in federal court in San Francisco by Sasha Antman, an Uber driver in Portland, Oregon, says the company did not do enough to prevent the 2014 breach and waited too long — about five months — to disclose it.

Antman says Uber violated a California law requiring companies to safeguard employee’s personal information.

Last month, Uber said it had discovered in September that an unknown person had gained access to a database containing the names and driver’s license numbers of thousands of drivers.

The suit, which seeks more than $5 million in damages, says Antman and other drivers “now face years of constant surveillance of their financial and personal records…and loss of rights.”

A spokeswoman for San Francisco-based Uber did not immediately return a request for comment on Friday. When the company announced the breach, it said there had been no reports of drivers’ information being misused.

While Uber has been growing in popularity and is now among the most valuable U.S. startups, it is also facing mounting legal challenges from drivers,…