🔍 Read the full analysis: Uber Drivers’ License Data At Risk: Responding To A Vendor Breach on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Uber has begun notifying people whose information was accessed through a third-party vendor, Fireworks.ai, after the vendor reported compromised internal credentials. Notices seen by TechCrunch say the data includes drivers’ license information, but Uber has not disclosed a national total; the company says it has not identified misuse so far.
Uber has begun notifying people that personal information was accessed through a breach at its third-party vendor Fireworks.ai, with drivers’ license information included in breach notices reviewed by TechCrunch. Uber’s filing with California regulators says the vendor told the company on October 9, 2026, that compromised internal credentials had been used to access Uber’s account with the vendor; the number of affected people nationwide is not known.
Uber’s notice says the company immediately severed data connections with the provider and investigated. By October 13, Uber determined that the unauthorized party had used the compromised credentials to access Uber data connected to the vendor. Uber’s California filing gives October 7 as the breach date and November 10 as the date it reported the incident. The notice does not describe an intrusion into Uber’s own systems.
The public sample notification leaves the affected-data field blank, so it does not identify the information involved for every recipient. TechCrunch reported that notices it reviewed include drivers’ license information. Uber’s notice says about 1,873 Rhode Island residents were affected. TechCrunch reported 2,567 people in Massachusetts and 3,430 in South Carolina, for 7,870 across those three states by simple addition. That is not a national total: the number of affected people in other states, including Illinois and California, has not been established publicly.
Uber is offering affected people free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must take place within 90 days of the date on an individual’s letter. Uber says it has not identified any misuse of the data to date; that statement does not establish that misuse cannot occur later.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
Drivers Need Their Individual Notices
The incident matters because drivers’ license information can be used to impersonate someone or support attempts at identity fraud. The public materials do not say every affected person had license data accessed; the individual letter is the document that identifies the information associated with its recipient. People who receive a notice should check its data field and the enrollment deadline rather than assume that all recipients face the same exposure.
The vendor link also shows how a security incident outside a company’s own infrastructure can still affect information it shares with a service provider. Uber says it cut the connection after receiving the alert, but the data had already been accessed. For affected drivers, the immediate practical questions are what information was involved, whether their notice is genuine, and how to use the offered monitoring service.
Products Worth Considering
Dell XPS Tower 8960 Desktop, Intel Core i7-13700, NVIDIA GeForce RTX 4060, 16GB DDR5, 512GB SSD
Apple MacBook Air 13-inch with M5 Chip, 16GB Memory, 512GB SSD, Silver
LG 27US500-W 27-Inch 4K UHD IPS Monitor
As an affiliate, we earn on qualifying purchases.
How the Fireworks Incident Reached Uber
Fireworks.ai provides a platform for businesses to run and customize open AI models. In its security bulletins, the company said it identified unauthorized use of internal credentials on October 6, Pacific time, and that an outside party accessed environment variables used in evaluation jobs in a limited number of customer accounts. Fireworks said it began notifying affected customers on October 7 and notified the customers it had identified by the evening of October 9.
Fireworks’ account and Uber’s filing describe events on overlapping dates, but the companies’ public statements do not identify which Fireworks system held the Uber data or explain the specific route by which it was accessed. In an update revised November 9, Fireworks said the incident had affected account and billing information and that, for a limited set of accounts, secrets, datasets and incomplete models were also affected. Fireworks has not named Uber in its bulletins; Uber identified the vendor in a statement to TechCrunch.
Fireworks said evidence linked the activity to a financially motivated group seeking to sell access to large language models, a practice known as LLMJacking. TechCrunch reported that no known group had claimed the theft. Those details concern the vendor’s broader investigation and do not establish who accessed the Uber data or what was done with it.
“Uber has not identified any misuse of your data to date.”
— Uber, in its notice to affected people
Affected Numbers and Data Scope
Uber has not published a nationwide count of affected people or said how many drivers it is notifying. The figures available so far come from state notices and reporting by TechCrunch. An Illinois filing reportedly identified drivers’ license information but said the number of affected residents was pending; the number notified in California also has not been disclosed publicly.
The exact information involved may vary by recipient, and the public sample letter does not fill in that field. Uber has not explained which Fireworks system held the data, how many people had license information accessed, or whether any other categories of personal information were taken. The companies have not publicly identified the person or group responsible for accessing Uber’s data.
Notices and State Counts to Follow
People who receive an Uber security notice should review the information listed in their individual letter and note the 90-day deadline for enrolling in the offered credit monitoring and fraud assistance. The available materials do not specify a single enrollment date for everyone; recipients should use the date on their own notice.
Further state filings or company updates may clarify the total number affected, the information involved and the investigation’s findings. Until Uber provides a broader count or more detail, the scale remains incomplete. Uber says it has not identified misuse as of its notice, while the longer-term status of the accessed information remains unknown.
Key Questions
Was Uber itself hacked?
Uber’s notice describes access through a service provider’s compromised credentials, not an intrusion into Uber’s own systems. Uber said the unauthorized party used those credentials to reach Uber data connected to its account with Fireworks.ai.
What information was exposed?
TechCrunch reported that breach notices it reviewed include drivers’ license information. The public sample letter leaves the affected-data field blank, so recipients need to consult their individual notice to see what information was listed for them.
How many people were affected?
A nationwide total has not been disclosed. The available figures include about 1,873 Rhode Island residents in Uber’s filing and counts of 2,567 in Massachusetts and 3,430 in South Carolina reported by TechCrunch. Other state counts remain incomplete or unpublished.
What should someone who receives a notice do?
Review the notice to identify the data listed and follow its instructions for the free credit monitoring and fraud assistance. Enrollment through Cyberscout must occur within 90 days of the letter date, according to Uber.
Source: ThorstenMeyerAI.com
