🔍 Read the full analysis: Could An AI Vendor Breach Put Uber Drivers’ License Details At Risk? on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Uber is notifying people whose information was accessed through Fireworks.ai, a third-party vendor, after the vendor reported compromised internal credentials. Breach notices reviewed by TechCrunch say the exposed information includes driver’s license details; Uber has not disclosed a national affected-person total and says it has found no misuse to date.
Uber is notifying people that personal information was accessed through a security incident at its third-party vendor Fireworks.ai, with breach notices reviewed by TechCrunch identifying driver’s license information among the data involved. Uber’s public notice does not name the vendor or specify the information for each recipient, and the number of affected Uber drivers nationwide is not known.
In a notice filed with the California attorney general and dated November 10, 2026, Uber said a service provider told the company on October 9 that an unauthorized party had compromised the provider’s internal credentials and used them to access Uber’s account with that provider. Uber said its investigation found on October 13 that Uber data connected to the service provider had been accessed. The California filing lists October 7 as the breach date.
The filing does not identify the vendor or list the data involved. An Uber spokesperson identified Fireworks.ai to TechCrunch as the vendor and said it “had access to some Uber data.” A Fireworks spokesperson told the outlet that the company had identified unauthorized access to some of its systems affecting customer data. The public sample notice leaves the affected-data field blank, so recipients’ individual letters are the documents that specify what information was involved for them.
Numbers reported in state notices show at least 1,873 Rhode Island residents, 2,567 Massachusetts residents and 3,430 South Carolina residents were affected, according to Uber’s filing and notices reviewed by TechCrunch. Those figures total 7,870 across the three states, but do not establish a nationwide count. TechCrunch also reported that an Illinois filing identified driver’s license information while leaving the number of affected people pending, and that Uber notified drivers in California without giving a count.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
Why License Details Matter
Driver’s license information is sensitive identifying data. Its exposure can raise concerns about identity fraud and misuse, although Uber says it has not identified any misuse of recipients’ information to date. The company is offering affected people credit monitoring and fraud assistance through Cyberscout, a TransUnion company.
The incident also highlights the risks of data handled outside a company’s own systems. Uber’s notice describes access through a service provider’s compromised credentials and to data connected to the vendor; it does not describe an intrusion into Uber’s own systems. People whose information was shared with a vendor may still face consequences when that provider is breached, even if they did not choose the provider themselves.
For drivers, the practical issue is to read the notice they receive and check which personal information it identifies. The available state counts give only a partial picture. Without a national total or a complete account of the affected data, recipients and the public cannot yet gauge the full reach of the incident.
Popular right now
Sony WH-1000XM6 Wireless Noise-Canceling Headphones, Black
De'Longhi Stilosa Compact Manual Espresso Machine with Milk Frother
Dyson Purifier Cool PC2 De-NOx
As an affiliate, we earn on qualifying purchases.
How the Vendor Incident Unfolded
Fireworks’ security bulletins say it identified unauthorized use of internal credentials on October 6, Pacific time, and that an unauthorized party accessed environment variables used in evaluation jobs in a limited number of customer accounts. Fireworks said it began notifying affected customers on October 7 and notified the customers it had identified on the evening of October 9. Uber’s reported timeline places its vendor alert on October 9 and its own investigation’s finding on October 13.
Fireworks’ update, last revised November 9, described impacts to account and billing information and said a limited set of accounts had impacts involving secrets, datasets and incomplete models. The company said evidence linked the activity to a financially motivated group seeking to sell unauthorized access to large language models, a practice known as “LLMJacking.” That is Fireworks’ assessment; TechCrunch reported that no known group had claimed the theft.
Uber’s notice says the company severed data connections with the service provider after receiving the alert and launched an investigation. The vendor’s bulletins do not name Uber, and neither company has publicly described which Fireworks system held the Uber data. The connection between the incident and the driver notices is based on Uber’s statement to TechCrunch identifying Fireworks as the vendor.
“An unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.”
— Uber, in the notice to affected people
The National Toll Remains Unknown
Uber has not said how many people nationwide it is notifying, or how many of them are drivers. Available figures come from separate state notices and do not amount to a full count. Illinois’ reported number was still pending, while the California filing and sample notice do not provide a complete total.
The public sample letter does not specify the information involved for every recipient. TechCrunch reported that notices it reviewed included driver’s license information, but recipients should consult their own letters to see which data was listed in their case. The companies have also not said which Fireworks system held the Uber information or provided a detailed account of how it was accessed.
Uber says it has found no misuse to date, but that statement does not establish whether the information could be misused later. Fireworks has described impacts across some customer accounts, but the extent of any overlap with Uber data remains undisclosed.
What Recipients Should Check
People who receive an Uber security notice should review it to identify the specific data involved and follow the enrollment instructions for free credit monitoring and fraud assistance through Cyberscout. Uber’s notice says enrollment must take place within 90 days of the letter date. Recipients can also use the contact information in the notice to ask questions about their individual case.
The next public developments to watch are any revised state filings that add affected-person counts, further details from Uber or Fireworks about the data involved, and updates on whether investigators identify misuse. No national total or further reporting timetable is given in the material available so far.
Key Questions
What happened to Uber drivers’ information?
Uber says a third-party vendor’s compromised internal credentials were used to access Uber data connected to the vendor. Uber identified the vendor to TechCrunch as Fireworks.ai. Notices reviewed by TechCrunch say driver’s license information was among the data involved.
How many people were affected?
A national total has not been disclosed. Reported state figures include 1,873 Rhode Island residents, 2,567 in Massachusetts and 3,430 in South Carolina. Those figures do not include a confirmed nationwide count, and Illinois’ reported number was pending.
Has Uber reported misuse of the information?
Uber said in its notice that it had not identified misuse to date. That is the company’s status report at the time of the notice; it does not establish whether misuse could occur later.
What should someone who receives a notice do?
Read the letter to see which personal information was involved, then follow its instructions for free credit monitoring and fraud assistance through Cyberscout. Uber says enrollment must be completed within 90 days of the letter date.
Source: ThorstenMeyerAI.com
