🔍 Read the full analysis: Driver License Data Stolen In Uber Breach: What Comes Next? on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Uber is notifying people whose personal information was accessed through a third-party vendor, identified by the company to TechCrunch as Fireworks AI. Breach notices reviewed by TechCrunch say the data includes driver’s license information; filings identify thousands of people across several states, but Uber has not disclosed a nationwide total. Letters offer free credit monitoring and fraud assistance, and Uber says it has not identified misuse so far.
Uber is notifying people that personal information was accessed through a compromised account at a third-party vendor, an incident the company identified to TechCrunch as Fireworks AI. Breach notices reviewed by TechCrunch say the accessed data includes driver’s license information; Uber’s public sample notice does not specify the data for each recipient, and the company has not provided a national count of affected people.
In a notice filed with the California attorney general and dated November 10, 2026, Uber said a service provider notified it on October 9 that an unauthorized party had compromised the provider’s internal credentials and used them to access Uber’s account with the provider. Uber said it severed data connections with the provider and investigated. On October 13, its investigation found that Uber data connected to the service provider had been accessed.
The filing does not name the vendor or list the personal information involved. Uber identified Fireworks.ai in a statement to TechCrunch, saying the vendor “had access to some Uber data.” Fireworks separately confirmed to the outlet that it had identified unauthorized access to some of its systems that affected customer data. The public sample notice leaves the affected-data field blank; recipients are directed to their individual letters for the information tied to them.
Available counts are drawn from state notices, not a nationwide tally. Uber’s filing says about 1,873 Rhode Island residents were affected. TechCrunch reported notices listing 2,567 people in Massachusetts and 3,430 in South Carolina. Those figures total 7,870 across the three states, but do not establish the incident’s full reach. TechCrunch also reported an Illinois filing in which the number of affected residents was pending and said Uber had notified drivers in California without giving a count.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
What Drivers Should Check Now
The notices put people whose information was handled by a vendor on alert, even though the reported intrusion was not described as a direct breach of Uber’s own systems. Driver’s license information is among the data identified in notices seen by TechCrunch, but the public filing does not say that every person received the same information exposure. The recipient’s letter is the source Uber provides for the specific data involved.
Uber’s sample letter offers affected people free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must take place within 90 days of the letter date. Uber says it has “not identified any misuse of your data to date.” That statement describes the company’s findings so far; it does not establish that information could not be misused later.
For readers who receive a notice, the immediate practical step is to check the letter’s description of exposed information and its enrollment deadline, then use the contact and enrollment details provided there. The available reporting does not establish that all Uber drivers were affected, or that all recipients’ licenses were accessed. The state counts are partial and should not be treated as a total for the United States.
Products Worth Considering
LG 27UP650K-W 27-inch Ultrafine 4K UHD IPS Monitor with HDR400, Reader Mode, Flicker Safe, HDMI & DisplayPort, Adjustable Stand (White)
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
Canon SELPHY CP1500 Wireless Dye-Sublimation Photo Printer Bundle with 108 Sheets of Paper and 3 Ink Cartridges
As an affiliate, we earn on qualifying purchases.
How the Vendor Incident Reached Uber
Fireworks AI provides tools for businesses to run and customize open AI models. Its security bulletins say it identified unauthorized use of internal credentials on October 6, Pacific time. The company said an unauthorized party accessed environment variables used in evaluation jobs in a limited number of customer accounts. Fireworks said it began notifying affected customers on October 7 and notified customers it had identified on the evening of October 9, Pacific time.
Those dates broadly align with Uber’s account of receiving a vendor alert on October 9 and discovering access to Uber data during its investigation on October 13. Uber’s California filing lists October 7 as the breach date and November 10 as the reporting date. The notice describes access through the service provider’s account and data connected to that provider; it does not describe an intrusion into Uber’s own systems.
Fireworks’ bulletin, last revised November 9 according to the supplied source, expanded its account of the effects. It reported impacts to account and billing information and said that, for a limited set of accounts, secrets, datasets and incomplete models were affected. Fireworks said evidence pointed to a financially motivated group seeking to sell tokens obtained through unauthorized access to large language models, a practice called “LLMJacking.” The supplied reporting says no known group had claimed the theft.
““An unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.””
— Uber, in the sample notice filed with the California attorney general
How Many People Were Affected
The national number of affected people remains unknown. Uber has not disclosed how many customers or drivers received notices, and available state filings provide only partial counts. Illinois’ count was still pending in the report cited by TechCrunch; the California notice did not give a number. The three reported counts from Rhode Island, Massachusetts and South Carolina total 7,870, but that is not a complete incident estimate.
It is also unclear exactly which data each recipient had exposed. Uber’s public sample letter contains a placeholder rather than a list of data fields, while TechCrunch reported that notices it reviewed included driver’s license information. The supplied material does not establish that every affected person’s license data was accessed, or identify the particular Fireworks system involved.
The cause and scope of the vendor incident are described in company notices and statements, but the full technical findings have not been provided in the material available here. Fireworks has linked the activity to financially motivated cybercriminals, while the source says no known group had claimed responsibility. Uber says it has not identified misuse to date; whether later investigation will find any remains unknown.
Notice Deadlines and Further Counts
People who receive an Uber letter can review it for the specific information involved and the steps to enroll in Cyberscout’s credit monitoring and fraud assistance. The stated enrollment period is 90 days from the letter date, so recipients should use the deadline and instructions in their own notice rather than assume every letter has the same delivery date.
Further state filings or company updates may clarify the number of people affected, including the pending Illinois count and the unreported totals for California and other locations. Uber and Fireworks may also provide more information about the affected systems and the scope of data access. The supplied material gives no date for a further public update, so those details remain pending.
For now, the confirmed account is that a vendor credential compromise led to access to Uber data associated with the vendor, followed by customer notifications. The exposed information and the scale may vary by recipient. Uber’s statement that it has found no misuse is a status report, not a final resolution of the incident.
Key Questions
What happened in the Uber incident?
Uber said a third-party provider notified it on October 9 that its internal credentials had been compromised. Uber later found that the credentials had been used to access Uber data connected to the provider. Uber identified the vendor as Fireworks.ai in a statement to TechCrunch.
Was driver’s license information exposed?
TechCrunch reported that breach notices it reviewed included driver’s license information. Uber’s public sample notice does not list the affected data, so recipients should check their own letter to see what information was involved in their case.
How many people were affected?
A nationwide total has not been disclosed. State figures reported so far include about 1,873 people in Rhode Island, 2,567 in Massachusetts and 3,430 in South Carolina. Those counts are partial; an Illinois count was pending, and a California total was not provided in the reporting.
What support is Uber offering?
Uber’s notice offers free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must be completed within 90 days of the letter date, according to the notice; recipients should follow the instructions in their own letter.
Has Uber found that the stolen data was misused?
Uber said it had not identified misuse to date. That is the company’s status as described in the notice, not a guarantee that misuse will never occur or that the investigation is complete.
Source: ThorstenMeyerAI.com
