🔍 Read the full analysis: Uber AI Vendor Breach: What The Stolen License Data Could Mean For Drivers on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Uber is notifying people whose information was accessed after a security incident involving Fireworks.ai, a third-party vendor with access to some Uber data. Breach notices seen by TechCrunch include drivers’ license information, but the public filings do not give a nationwide total or identify every data field involved for each recipient.
Uber is notifying people whose personal information was accessed through Fireworks.ai, a third-party vendor, after the vendor reported that compromised internal credentials had been used to reach an Uber account. Notices seen by TechCrunch include drivers’ license information, but Uber has not disclosed a national count of affected people or specified publicly which data was involved for each recipient.
Uber’s notice filed with the California attorney general says a service provider told the company on October 9 that an unauthorized third party had compromised the provider’s internal credentials and used them to access Uber’s account with the provider. Uber says its investigation determined on October 13 that the credentials had been used to access Uber data connected to the service. The filing lists October 7 as the breach date and November 10 as the reporting date.
The public notice does not name the vendor, and its sample letter leaves the affected-data field blank. An Uber spokesperson identified the vendor as Fireworks.ai in a statement to TechCrunch, saying it had access to some Uber data. A Fireworks spokesperson told the outlet the company had identified unauthorized access to some of its systems that affected customer data. TechCrunch reports that breach notices it reviewed include drivers’ license information; individual recipients need to consult their letters to learn which information was listed for them.
Uber’s filing estimates that about 1,873 Rhode Island residents were affected. TechCrunch reports notices covering 2,567 people in Massachusetts and 3,430 in South Carolina. Those three state figures total 7,870, but they do not represent a confirmed national count. TechCrunch also reported that an Illinois filing listed driver’s license information while leaving the number of affected residents pending, and that California drivers were notified without a public count.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
Why License Exposure Matters to Drivers
A driver’s license number is a sensitive identifier that can be used in attempts to impersonate someone or support fraud. The notices establish that license information was among the data reported in at least some affected cases, but they do not establish that every recipient’s license details were accessed or that anyone has used the information improperly.
For drivers, the immediate practical issue is to read the letter carefully: the public sample does not identify the specific data fields for each person. Uber says it has not identified any misuse to date. That is a statement about what the company has found so far, not proof that misuse cannot occur later. The breach also matters beyond Uber because the initial access was through a service provider’s credentials, rather than an intrusion that Uber’s notice describes as being into its own systems.
Uber is offering affected people free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. The stated enrollment period is 90 days from the date of the letter. Credit monitoring may help detect some activity associated with identity misuse, but it does not itself prevent every form of fraud involving license information.
Popular right now
De'Longhi Magnifica Duo Fully Automatic Espresso Machine with Milk Frother, Silver
Hisense 55-Inch E6SR Series Hi-QLED 4K UHD Smart Roku TV (55E6SR, 2026 Model)
Dyson V9 Motorbar Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
How the Fireworks Incident Reached Uber
Fireworks provides a platform for businesses to run and customize open AI models. Its security bulletins say it identified unauthorized use of internal credentials on October 6, Pacific time. The company reported that an unauthorized party accessed environment variables used in evaluation jobs in a limited number of customer accounts, and that it began notifying affected customers on October 7. On the evening of October 9, it said it had notified the affected customers it had identified and published an initial bulletin.
The timing broadly aligns with Uber’s account: Uber says the provider notified it on October 9, while its California filing records October 7 as the breach date. Uber says it severed data connections with the provider after receiving the alert and began investigating. The filing describes access to Uber’s account with the service provider and Uber data connected to that service; it does not describe an intrusion into Uber’s own systems.
In a security update last revised November 9, Fireworks said the incident affected account and billing information and that, for a limited set of accounts, secrets, datasets and incomplete models were also affected. Fireworks said evidence links the activity to a financially motivated group seeking to sell unauthorized access to large language models, a practice called LLMJacking. TechCrunch reported that no known group had claimed the theft. Those broader vendor findings do not specify which Fireworks system contained the Uber data or what data was taken from Uber’s account.
““We have not identified any misuse of your data to date.””
— Uber, in its notice to affected people
What the Notices Do Not Specify
The total number of affected people nationwide is not known from the public information. State filings provide partial counts, while the Illinois number was pending and the California filing did not provide a count in the reporting described by TechCrunch. Uber has not said how many customers or drivers it is notifying overall.
It is also unclear which specific information was accessed for each recipient, which Fireworks system held the Uber data, and whether the accessed information was copied or used. The sample letter leaves the data field blank for completion in individual notices. TechCrunch’s review indicates that some notices include license information; that does not establish that it was involved in every case.
Uber has said it found no misuse to date. The public material does not establish whether that assessment has changed since the notices were issued, nor does it provide details about any law-enforcement investigation. Fireworks’ statements about the suspected financial motive concern the wider vendor incident and do not identify a confirmed actor responsible for accessing Uber’s data.
What Affected Drivers Should Do
People who receive an Uber notice should check the letter for the specific information listed, the date of the notice and instructions for enrolling in Cyberscout’s credit-monitoring and fraud-assistance services. Uber says enrollment must take place within 90 days of the letter date. The public information does not state that every Uber driver is affected, so the company’s notice—not the broader reporting—is the clearest source for an individual’s status.
Uber and Fireworks may provide further details as state filings and their investigations develop. Readers should look for updates to the affected-person counts, clarification of which categories of Uber data were involved, and any change to Uber’s statement about detected misuse. Until then, the scale remains incomplete and the known state figures should not be treated as a nationwide total.
Key Questions
What happened to Uber drivers’ data?
Uber says a third-party vendor’s compromised internal credentials were used to access an Uber account with that vendor. TechCrunch reports that notices sent to affected people include drivers’ license information. The public sample letter does not specify the data involved for every recipient.
Was Uber itself hacked?
Uber’s notice describes access through an account with its service provider and to Uber data connected to that service. It does not describe an intrusion into Uber’s own systems.
How many people were affected?
There is no confirmed national total. The reported figures include about 1,873 Rhode Island residents in Uber’s filing, plus 2,567 in Massachusetts and 3,430 in South Carolina reported by TechCrunch. Other state counts were not available or remained pending.
What support is Uber offering?
Uber says affected people can get free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. The enrollment period is 90 days from the date of the person’s letter.
Has Uber found that the data was misused?
Uber said it had not identified misuse to date. The company’s statement describes its findings at the time of the notice and does not rule out later developments.
Source: ThorstenMeyerAI.com
