🔍 Read the full analysis: Uber Drivers’ License Data: How To Respond To The Reported Breach on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Uber has begun notifying people whose information was accessed through a third-party vendor, Fireworks.ai, after the vendor reported compromised internal credentials. TechCrunch reports that breach notices include driver’s license information, but Uber’s public sample notice does not specify the data for each person, and the total number affected nationally is unknown.
Uber is notifying people that personal information linked to its account with a third-party provider was accessed after the provider’s internal credentials were compromised. Uber identified the vendor as Fireworks.ai in comments to TechCrunch; the outlet reports that some notices list driver’s license information among the data taken, while Uber’s public sample letter does not specify which information was involved for each recipient.
In a notice filed with the California attorney general, Uber said a service provider told the company on October 9 that an unauthorized party had compromised the provider’s internal credentials and used them to access Uber’s account with that provider. Uber said its investigation found on October 13 that Uber data had been accessed. The filing lists October 7 as the breach date and November 10 as the reporting date.
The notice does not name the vendor. An Uber spokesperson told TechCrunch the incident involved Fireworks.ai, which had access to some Uber data. Fireworks confirmed to the outlet that it identified unauthorized access to some of its systems affecting customer data. Uber’s notice says the company severed data connections with the provider after learning of the incident and began an investigation.
Uber says its notice affected approximately 1,873 Rhode Island residents. TechCrunch reported figures of 2,567 people in Massachusetts and 3,430 in South Carolina, based on notices it reviewed. Together, those state figures total 7,870, but they do not represent a confirmed national total. TechCrunch also reported that an Illinois filing identified driver’s license information but listed the number of affected people as pending, and that Uber notified California drivers without publishing a count.
Uber is offering affected people credit monitoring and fraud assistance through Cyberscout, a TransUnion company. The company says people must enroll within 90 days of the date on their letter. Uber said it had “not identified any misuse of your data to date.”
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
What Drivers Should Check Now
For recipients, the most useful source of detail is the individual Uber notification letter. The public sample leaves the affected-data field blank for each recipient, so it cannot establish whether a particular person’s license details, or other personal information, were accessed. People who receive a letter should read that field carefully and follow the enrollment instructions if they want the offered monitoring and assistance.
The reported exposure also raises a practical concern beyond Uber’s own systems: companies may share personal information with outside providers, and an incident at a vendor can affect people who did not choose or interact with that vendor. Here, Uber describes access through an account with its service provider, not an intrusion into Uber’s own systems. The number of people affected remains incomplete, making it difficult to gauge the full reach of the incident.
Credit monitoring and fraud assistance are support measures, not proof that identity fraud has occurred or a guarantee that misuse will be prevented. Uber’s statement that it has found no misuse is limited to what the company has identified so far. Recipients should use the contact details and deadlines in their own letters and remain alert to unexpected requests for personal information.
Products Worth Considering
Canon SELPHY CP1500 Compact Photo Printer Bundle with Ink and Paper Set, White
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
Vari Ergo Electric Standing Desk, 54×26, Light Wood/White
As an affiliate, we earn on qualifying purchases.
How the Vendor Incident Reached Uber Data
Fireworks.ai provides businesses with a platform to run and customize open artificial intelligence models. Its own security bulletins say it identified unauthorized use of internal credentials on October 6, Pacific time, and that an unauthorized party accessed environment variables used in evaluation jobs in a limited number of customer accounts. Fireworks said it began notifying affected customers on October 7 and contacted the customers it had identified on the evening of October 9.
The dates broadly match Uber’s account: its filing gives October 7 as the breach date and says the provider notified it on October 9. Fireworks’ update, last revised November 9, also describes effects on account and billing information and says that, for a limited set of accounts, secrets, datasets and incomplete models were affected. Its bulletins do not name Uber or identify which Fireworks system held the Uber-related data.
Fireworks said evidence linked the activity to a financially motivated group seeking to sell tokens obtained through unauthorized access to large language models, a practice called “LLMJacking.” That is the company’s assessment; TechCrunch reported that no known group had claimed the theft. The available account does not establish that the alleged financial motive explains the access to Uber data specifically.
““An unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.””
— Uber, in its breach notice
The National Count and Data Scope
The total number of affected people nationwide is not known. The available figures cover selected state filings and notices reviewed by TechCrunch, while counts for California and Illinois were not provided in the reported material. Uber has not said how many customers or drivers it is notifying overall.
It is also not clear which specific data fields were accessed for each recipient. The sample notice reviewed in the California filing leaves that information as a placeholder, while TechCrunch reports that notices it reviewed include driver’s license information. Recipients need to consult their own letters to learn what Uber says applied to them.
Neither company has publicly identified the particular Fireworks system that held the Uber data or explained how the information was stored there. Uber says it has found no misuse to date, but the sources provided do not describe the scope of ongoing monitoring or establish whether all potentially affected people have been identified.
More Notices and State Counts
People who receive an Uber letter should check the data fields, enrollment instructions and 90-day deadline stated in that notice. They can use the monitoring and fraud-assistance service described by Uber and contact the company through the information printed in the letter if they need clarification about which data was involved.
The scope may become clearer if Uber provides a national count or additional state filings report figures that are currently pending or undisclosed. Uber and Fireworks may also release further details about the affected systems and the investigation. As of the November 10 notice, however, those details had not been established publicly in the source material.
Key Questions
What happened to Uber-related data?
Uber said a provider notified it that compromised internal credentials had been used to access Uber’s account with that provider. Uber later identified the vendor as Fireworks.ai to TechCrunch. Uber’s notice describes access to data connected to the provider, not an intrusion into Uber’s own systems.
Was my driver’s license information exposed?
TechCrunch reported that breach notices it reviewed included driver’s license information. Uber’s public sample notice leaves the affected-data field blank, so it does not show what information applied to a particular person. Check your individual letter for those details.
How many people were affected?
Uber’s notice gives a count of about 1,873 Rhode Island residents. TechCrunch reported 2,567 in Massachusetts and 3,430 in South Carolina, while counts in other states were not fully available. There is no confirmed national total in the source material.
What assistance is Uber offering?
Uber says affected people can receive credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must take place within 90 days of the date on the recipient’s letter; follow that letter for the specific instructions.
Has Uber reported identity fraud from the incident?
Uber said it had not identified misuse of the data to date. That is the company’s status statement as of its notice, not confirmation that misuse is impossible or that every affected person’s information has been reviewed for all future activity.
Source: ThorstenMeyerAI.com
