🔍 Read the full analysis: Driver License Data And The Uber Breach: A Practical FAQ on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Uber is notifying people whose information was accessed through a third-party vendor, Fireworks AI, after the vendor’s internal credentials were compromised. Breach notices reported by TechCrunch include driver’s license information, but Uber has not disclosed a national total or named every affected data field; recipients should check their individual letter.
Uber is notifying people whose personal information was accessed through Fireworks AI, a third-party vendor, after the vendor reported that compromised internal credentials had been used to reach Uber data. Notices reviewed by TechCrunch say the exposed information includes driver’s license data; Uber has not released a nationwide count of affected people.
In a notice filed with the California attorney general and dated November 10, 2026, Uber said a service provider told it on October 9 that an unauthorized third party had compromised the provider’s internal credentials and used them to access Uber’s account with the provider. Uber said its investigation found on October 13 that Uber data had been accessed. The filing lists October 7 as the breach date.
The regulatory notice does not name the provider or specify the affected information in its public sample letter. An Uber spokesperson told TechCrunch the incident involved Fireworks.ai, which had access to some Uber data. TechCrunch reported, based on breach notices it reviewed, that driver’s license information was among the data taken. The sample letter leaves the data field blank for recipient-specific information, so each person’s letter is the source for what information about them was involved.
State figures give only a partial picture: Uber’s notice says about 1,873 Rhode Island residents were affected. TechCrunch reported 2,567 people in Massachusetts and 3,430 in South Carolina, a combined 7,870 across those three states. Illinois reported that the number of affected residents was pending, while TechCrunch said California drivers were also notified. These figures do not establish the total across the United States.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
Why License Data Raises Concern
A driver’s license number is a sensitive identifier, and its exposure can create risks of identity misuse or fraud. The incident also shows how personal information can be affected through a vendor relationship: Uber’s account of the event describes access through a service provider’s credentials, not an intrusion into Uber’s own systems.
For affected people, the practical issue is whether their specific letter lists license information and what support is available. Uber says it has not identified misuse to date, but that statement does not rule out future misuse. The company is offering credit monitoring and fraud assistance through Cyberscout, a TransUnion company; enrollment must be completed within 90 days of the letter date.
The state-by-state disclosures also leave drivers without a clear picture of the incident’s full reach. A three-state sum is not a national estimate, and the reported figures omit states where counts are pending or undisclosed. That limits public understanding of the scale while individual notices continue to provide recipients with more specific information.
Products Worth Considering
Anker SOLIX C1000 Gen 2 Portable Power Station with 100W Solar Panel
Jackery Explorer 300 Portable Power Station, 292Wh
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
As an affiliate, we earn on qualifying purchases.
How the Vendor Incident Reached Uber
Fireworks AI provides a platform businesses use to run and customize open AI models. Its security bulletins say it identified unauthorized use of internal credentials on October 6, Pacific time, and that a third party accessed environment variables used in evaluation jobs in a limited number of customer accounts. Fireworks said it began notifying affected customers on October 7 and notified the customers it had identified on October 9.
Uber’s timeline says the provider alerted it on October 9, followed by Uber severing data connections and starting an investigation. The company’s October 13 finding and November 10 notices track the later steps of that response. Fireworks’ update, last revised November 9, described impacts to account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. The companies have not said which Fireworks system contained the Uber data.
Fireworks said evidence linked the activity to a financially motivated group seeking to sell access to large language models, a practice called “LLMJacking.” That is the company’s assessment; TechCrunch reported that no known group had claimed the theft. This account concerns the data connected to Uber and does not establish that every category affected in the wider Fireworks incident was involved in Uber’s data.
“An unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.”
— Uber, in its notice to affected people
What the Notices Do Not Establish
The national number of affected people has not been disclosed. Uber did not provide TechCrunch with a total count of customers or drivers receiving notices. State filings offer partial figures, and at least one state’s count was pending in the reporting cited by TechCrunch.
The public sample letter does not list the recipient’s affected data, and the companies have not explained which Fireworks system held Uber information or which data fields were accessed for each person. TechCrunch reported driver’s license information in notices it reviewed, but that does not establish that every recipient’s license data was involved. The source material also does not say whether the affected data included license images, numbers, or other details.
Uber says it has found no misuse so far. The duration of access, whether data was copied or further distributed, and whether additional affected people or information will be identified remain unclear.
What Drivers Should Check Now
People who receive a letter should read its recipient-specific data field and follow the enrollment instructions for Cyberscout’s credit monitoring and fraud assistance. Uber’s notice sets a 90-day enrollment window from the letter date. Anyone unsure whether a message is genuine can use contact details from Uber’s official channels rather than links in an unexpected message.
Further clarity depends on additional notices, state filings and updates from Uber or Fireworks. The companies may provide a fuller affected-person count or more detail about the data involved, but no such national total or system-level explanation is established in the available material. Until then, affected people should rely on their own notice for the information Uber says applies to them.
Key Questions
Was Uber itself hacked?
Uber’s notice says the access occurred through a service provider’s compromised internal credentials, which were used to reach Uber’s account with that provider. Uber has not described the event as an intrusion into its own systems.
What information was exposed?
TechCrunch reported that breach notices it reviewed included driver’s license information. The public sample letter leaves the affected-data field blank, so recipients should check their own letter; the available information does not establish that every person’s license data was involved.
How many people were affected?
There is no disclosed national total. Uber reported about 1,873 Rhode Island residents; TechCrunch reported 2,567 in Massachusetts and 3,430 in South Carolina. Those figures cover three states only, and other state counts were undisclosed or pending.
What should someone who receives a notice do?
Read the notice to identify which data Uber says was involved and follow the instructions for credit monitoring and fraud assistance through Cyberscout. Enrollment must occur within 90 days of the letter date. Uber says it has not identified misuse so far.
Source: ThorstenMeyerAI.com
