🔍 Read the full analysis: Uber Data Breach Exposes Driver License Data Through An AI Vendor on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Uber has begun notifying people in the United States that their information was accessed through a compromised account at third-party AI vendor Fireworks.ai. Notices reported by TechCrunch say the exposed information includes driver’s license data, but Uber has not given a national count of affected people.
Uber has begun notifying people in the United States that their personal information was accessed after a third party used compromised credentials at Fireworks.ai, an AI vendor with access to some Uber data. Breach notices reviewed by TechCrunch say the information included driver’s license data; Uber’s public sample notice does not specify which data was involved for each recipient.
In a notice filed with California regulators and dated November 10, 2026, Uber said a service provider notified it on October 9 that an unauthorized party had compromised the provider’s internal credentials and used them to access Uber’s account there. Uber said its investigation found on October 13 that Uber data had been accessed. The filing lists October 7 as the breach date.
The filing does not name the service provider. An Uber spokesperson identified it as Fireworks.ai in a statement to TechCrunch, saying the vendor “had access to some Uber data.” Fireworks also told TechCrunch it had identified unauthorized access to some of its systems that affected customer data. The notices described by TechCrunch say driver’s license information was among the exposed data, though the public sample letter leaves the affected-data field blank for individual recipients.
Available state figures do not establish the total number affected nationwide. Uber’s filing estimates 1,873 Rhode Island residents were affected. TechCrunch reported figures of 2,567 in Massachusetts and 3,430 in South Carolina, which total 7,870 across those three states. Illinois filings reportedly list driver’s license information but say the count was pending; the number of California recipients has not been disclosed. Uber has not provided a national total.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
Driver Data Reached an AI Vendor
The incident shows how personal information can be exposed through a company that provides services to a business, rather than through a reported intrusion into the business’s own systems. Uber’s notice describes access to its account with the provider and data connected to that service. It does not describe an attacker breaking into Uber’s internal systems.
For affected drivers, a driver’s license number is sensitive identifying information, and its exposure can create risks of identity misuse. Uber says it has not identified misuse to date; that statement describes what the company has found so far, not a guarantee that misuse will not occur. The case also raises practical questions about how companies assess vendor access and what information those vendors can reach.
People who receive a notice should check the letter for the specific information involved and the steps available to them. Uber is offering free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must be completed within 90 days of the letter date, according to the notice.
Popular right now
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
Roborock RockNeo Q110H Wire-Free Robot Lawn Mower
Vitamix 5200 Blender with 64 oz Container, Black
As an affiliate, we earn on qualifying purchases.
How the Fireworks Incident Unfolded
Fireworks describes itself as a platform for running and customizing open AI models for businesses. In security bulletins, the company said it identified an incident on October 6 involving unauthorized use of internal Fireworks credentials. It said an unauthorized party accessed environment variables used in evaluation jobs in a limited number of customer accounts, and that it began notifying affected customers on October 7.
Fireworks said it notified customers it had identified on the evening of October 9 and published its first bulletin. Those dates broadly align with Uber’s account that a provider alerted it on October 9 and with the October 7 breach date in Uber’s California filing. Fireworks’ update, last revised November 9, also described impacts to account and billing information and said secrets, datasets and incomplete models were affected for a limited set of accounts. Its bulletins do not identify Uber.
Fireworks said evidence linked the activity to a financially motivated group seeking to sell access to large language models, a practice it described as “LLMJacking.” That is the company’s assessment of the activity, not a publicly confirmed identification of the person or group responsible for the Uber-related data access. TechCrunch reported that no known group had claimed the theft.
““An unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.””
— Uber, in its notice to affected individuals
The Affected Driver Count Is Unknown
The national number of affected people remains unknown. State filings and figures reported by TechCrunch provide partial counts, while Illinois’ figure was pending and Uber has not disclosed how many California residents received notices. The available totals should not be treated as a complete count of affected drivers or customers.
It is also not clear from the public sample notice which specific information was accessed for each recipient. The sample’s data field is blank, and individual letters supply that detail. Neither Uber nor Fireworks has publicly explained which Fireworks system held the Uber data, how it was stored, or precisely how the compromised credentials enabled access to it.
The companies have not publicly confirmed that the exposed license information has been misused. Uber says it has found no misuse to date. The identity of the person or group responsible for the access, and whether any data was taken beyond the information described in notices, also remain unclear.
Check Notices and State Filings
People who receive an Uber security notice should use it to identify the data involved and review the enrollment instructions for Cyberscout’s credit monitoring and fraud assistance. The stated deadline is 90 days from the letter date. Those who have not received a letter but believe they may be affected can watch for further company communications and updates to state breach filings.
Further information may come from Uber’s notices to regulators and individuals, as well as updates from Fireworks about the incident. Key unanswered details include the national recipient count, a fuller account of the data involved, and whether investigators find evidence of misuse. No further public milestone or timeline was specified in the source material.
Key Questions
What happened in the Uber data incident?
Uber says a third-party provider alerted it on October 9, 2026, that compromised internal credentials had been used to access Uber’s account with the provider. Uber’s investigation found that Uber data connected to the service had been accessed.
Was Fireworks.ai the vendor involved?
Yes. Uber identified Fireworks.ai as the vendor in a statement to TechCrunch. Fireworks separately confirmed an unauthorized-access incident affecting customer data, but its public bulletins do not name Uber.
Was driver’s license information exposed?
TechCrunch reported, citing breach notices, that the stolen information included driver’s license data. Uber’s public sample letter does not specify the affected information; recipients should check their individual notice for details.
How many people were affected?
A complete national figure has not been disclosed. Reported figures include 1,873 Rhode Island residents in Uber’s filing, plus 2,567 people in Massachusetts and 3,430 in South Carolina, according to TechCrunch. Other state counts are missing or pending.
What help is Uber offering?
Uber is offering free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. The notice says enrollment must take place within 90 days of the letter date.
Source: ThorstenMeyerAI.com
