🔍 Read the full analysis: How The Uber Data Breach Put Driver License Data At Risk on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Uber is notifying people whose information was accessed after a breach of third-party vendor Fireworks AI, which had access to some Uber data. Notices reviewed by TechCrunch say driver’s license information was among the data involved, but Uber’s public sample notice does not specify the affected data or give a national count.
Uber is notifying people whose information was accessed through a breach at Fireworks AI, a third-party vendor that had access to some Uber data; breach notices reviewed by TechCrunch say the exposed information includes driver’s license data. Uber’s public sample notice does not identify the affected data for each recipient, and the company has not disclosed a nationwide total of people affected.
In a notice filed with the California attorney general and dated November 10, 2026, Uber said a service provider notified it on October 9 that an unauthorized party had compromised the provider’s internal credentials and used them to access Uber’s account with the provider. Uber said it cut data connections with the vendor and began investigating. On October 13, the investigation found that Uber data connected to the service provider had been accessed.
The filing does not name the vendor or specify which data was involved. Uber identified Fireworks.ai as the provider in a statement to TechCrunch, saying it had access to some Uber data. TechCrunch reported that notices it reviewed list driver’s license information. Uber’s publicly available sample letter leaves the data field blank, so recipients must check their own letters to learn what personal information was involved in their case.
The reported counts come from state notices and do not establish the total affected nationwide. Uber’s filing says approximately 1,873 Rhode Island residents were affected. TechCrunch reported notices covering 2,567 people in Massachusetts and 3,430 in South Carolina. Those figures total 7,870 across the three states, but Uber has not said how many people overall received letters. TechCrunch also reported that an Illinois filing identified driver’s license information but left the number affected pending, and that Uber notified drivers in California without stating a count.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
Why Driver License Exposure Matters
A driver’s license contains personal identifying information that can be relevant to identity fraud. The confirmed scope remains limited to people whose information was accessed through the vendor incident; the available material does not establish that anyone has used the data for fraud. Uber said it had not identified misuse of affected information as of its notice.
The incident also shows how personal data can be exposed outside a company’s own systems. Uber described access to its account and data held with a service provider, rather than reporting an intrusion into Uber’s internal systems. For drivers, however, the practical question is the same: what information was involved, and what steps can they take to monitor for misuse?
Uber is offering affected people free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. The letter says enrollment must take place within 90 days of its date. That service may help recipients monitor some forms of identity-related activity, but it does not resolve the open questions about the full scale or possible consequences of the exposure.
Products Worth Considering
LG UltraGear 34-inch Curved OLED Gaming Monitor, WQHD 1440p, 240Hz, 0.03ms, 800R
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
LG UltraGear evo 27-inch 5K Mini-LED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How Fireworks Became the Link
Fireworks provides a platform businesses use to run and customize open AI models. Its security bulletins say it identified unauthorized use of internal credentials on October 6, Pacific time, and that a third party accessed environment variables used in evaluation jobs in a limited number of customer accounts. Fireworks said it began notifying affected customers on October 7 and contacted the customers it had identified on October 9.
The timeline broadly corresponds with Uber’s notice, which lists October 7 as the breach date and says the vendor notified Uber on October 9. Fireworks’ public bulletins do not name Uber, and the companies have not said which Fireworks system contained the Uber data. A Fireworks spokesperson told TechCrunch that the company had identified unauthorized access to some of its systems affecting customer data.
In an update last revised November 9, Fireworks said the incident affected account and billing information and that, for a limited set of accounts, secrets, datasets and incomplete models were also affected. Fireworks attributed the activity to a financially motivated group seeking to sell unauthorized access to large language models, a practice called “LLMJacking.” That is Fireworks’ assessment; TechCrunch reported that no known group had claimed the theft.
“An unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.”
— Uber, in its notice to affected people
Who Was Affected and What Was Taken
The national number of affected people is unknown. State notices provide partial counts, while Uber has not said how many customers or drivers it contacted. The reported 7,870 total covers only Rhode Island, Massachusetts and South Carolina; it should not be treated as a complete count. Illinois’ number was pending, and the California filing does not provide a total in the supplied material.
The exact data involved may differ by recipient. The public sample notice leaves the affected-data field blank, and the companies have not publicly explained which Fireworks system held the Uber information or how it was accessed beyond the use of compromised credentials. TechCrunch’s reporting identifies driver’s license information in notices it reviewed, but the supplied information does not establish that every recipient’s license data was exposed.
It is also unclear whether any affected information has been misused. Uber said it had not identified misuse at the time of its notice. Fireworks’ account of the suspected actor and motive is the company’s assessment; the available material does not independently confirm the group’s identity or establish that it took Uber driver data for resale.
Notice Details and Monitoring Deadlines
People who receive an Uber notice should use the individual letter to identify which data Uber says was involved and follow its instructions for enrolling in Cyberscout monitoring and fraud assistance. According to the notice, enrollment must occur within 90 days of the letter date. Recipients should refer to the letter for the applicable deadline and service details.
Further state filings or updates from Uber could clarify the number of people affected, including the pending Illinois count and the totals for states where notices have been reported without a figure. Uber and Fireworks have not announced a complete public accounting in the supplied material. Until one is available, the state figures remain partial, and the scope of exposed information should be understood from each recipient’s notice rather than inferred from the public sample.
Key Questions
Was Uber itself breached?
Uber’s notice says compromised credentials at a service provider were used to access Uber’s account and data connected to that provider. It does not describe an intrusion into Uber’s own internal systems.
Was driver’s license information exposed?
TechCrunch reported that breach notices it reviewed include driver’s license information. Uber’s public sample letter leaves the data field blank, so the exact information involved may depend on the recipient’s individual notice.
How many people were affected?
Uber has not disclosed a national total. Notices cited in the source material report about 1,873 people in Rhode Island, 2,567 in Massachusetts and 3,430 in South Carolina; the combined 7,870 covers only those three states.
What is Uber offering affected people?
Uber is offering free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. The notice says recipients must enroll within 90 days of its date.
Has anyone misused the exposed information?
Uber said it had not identified misuse as of the notice. The available information does not establish whether misuse will occur later or whether all affected data has been identified.
Source: ThorstenMeyerAI.com
