🔍 Read the full analysis: Was Your License Data Exposed In The Uber AI Vendor Breach? on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Uber is notifying people whose information was accessed through a breach involving its AI vendor, Fireworks.ai. Notices reviewed by TechCrunch say the exposed data includes driver’s license information, but Uber has not provided a nationwide count or said which data was involved for each recipient. The company says it has not identified misuse and is offering affected people credit monitoring and fraud assistance.
Uber is notifying people whose personal information was accessed through a security incident at its vendor Fireworks.ai, and breach notices reviewed by TechCrunch say the data includes driver’s license information. Uber’s public sample notice leaves the affected-data field blank, so recipients need to check their own letters to learn what information about them was involved; the company has not published a nationwide count.
In a notice dated November 10, 2026, filed with the California attorney general, Uber said a service provider told it on October 9 that an unauthorized party had compromised the provider’s internal credentials and used them to access Uber’s account with that provider. Uber said its investigation found on October 13 that Uber data had been accessed. The filing lists October 7 as the breach date.
The filing does not name Fireworks or specify the data involved. Uber identified the vendor to TechCrunch as Fireworks.ai, saying it had access to some Uber data. TechCrunch reported that notices it reviewed list driver’s license information among the stolen data. The public sample letter, however, uses a placeholder for the affected information rather than listing a single set of data for everyone.
State disclosures so far give partial counts: Uber’s notice says about 1,873 Rhode Island residents were affected; TechCrunch reported 2,567 people in Massachusetts and 3,430 in South Carolina. Those three figures add to 7,870, but they are not a national total. TechCrunch also reported that an Illinois filing listed driver’s license information while leaving the number of affected residents pending, and that Uber notified California drivers without giving a count.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
What Drivers Should Check Now
A driver’s license number is sensitive identifying information. If it was among the data accessed, recipients may want to use the assistance Uber is offering and watch for suspicious activity connected to their identity. The notices do not establish that anyone has used the information fraudulently: Uber says it has not identified any misuse to date.
Uber is offering affected people credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must be completed within 90 days of the letter date. Because the public sample does not identify each recipient’s exposed data, the individual notice is the clearest available source for determining what was involved. People who receive a letter should follow its instructions and note the enrollment deadline.
The incident also shows how personal information entrusted to a company can be exposed through a separate service provider. Uber’s account describes access through its account with the vendor, not an intrusion into Uber’s own systems. That distinction identifies the reported route of access, but does not reduce the need for affected people to understand what information was involved.
Popular right now
Ninja CREAMi 7-in-1 Ice Cream Maker, NC301
Roborock Q7 M5+ Robot Vacuum and Mop
Dyson V9 Motorbar Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
How the Vendor Incident Reached Uber
Fireworks provides a platform for businesses to run and customize open AI models. In its security bulletins, the company said it identified unauthorized use of internal credentials on October 6, Pacific time. It said an unauthorized party accessed environment variables used in evaluation jobs in a limited number of customer accounts. Fireworks said it began notifying affected customers on October 7 and notified the customers it had identified by the evening of October 9.
Those dates broadly align with Uber’s account: the California filing lists October 7 as the breach date, and Uber says its provider alerted it on October 9. The companies have not publicly specified which Fireworks system held the Uber data or how the driver information was connected to the accessed account. Fireworks’ bulletins describe effects involving account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models.
Fireworks said evidence links the activity to a financially motivated group seeking to sell tokens obtained through unauthorized access to large language models, a practice known as “LLMJacking.” That is the company’s assessment; TechCrunch reported that no known group had claimed the theft. The available material does not establish that this activity involved the driver information specifically.
““An unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.””
— Uber, in its notice to affected people
What the Notices Do Not Establish
The total number of affected people remains unknown. Uber has not disclosed a national figure or said how many drivers it is notifying. The state counts cover only reported jurisdictions, and Illinois’ number was still pending in the filing described by TechCrunch. The available reports do not show whether the disclosed state figures represent all affected people in those states.
It is also not clear which data was accessed for each individual, how many recipients had driver’s license information exposed, or which Fireworks system contained the Uber data. The public sample letter leaves the data field blank for details specific to each recipient. Uber’s statement that it has found no misuse is a report of its investigation so far, not a finding that the information cannot be misused.
Watch for Notices and Updated Counts
People who receive an Uber security notice should use the letter to identify the data involved and follow its instructions for Cyberscout’s credit monitoring and fraud assistance. The stated enrollment window is 90 days from the letter date. Readers should use the contact information in the notice or verify it through official Uber channels if they are unsure whether a message is genuine.
Further state filings or company updates may clarify the number of people affected and the categories of information involved. Uber and Fireworks have not, in the cited material, provided a nationwide total or a detailed account of how the driver data was stored and accessed. Until they do, the figures reported by state are partial and the recipient’s own notice remains the best available guide to their specific exposure.
Key Questions
Was driver’s license information exposed?
TechCrunch reported that breach notices it reviewed included driver’s license information. Uber’s public sample notice leaves the affected-data field blank, so a recipient should check their own letter to see what information was involved in their case.
How many people were affected?
There is no published nationwide total. The figures provided or reported so far include about 1,873 people in Rhode Island, 2,567 in Massachusetts and 3,430 in South Carolina. Other state counts were not available in the cited reports.
Was Uber itself breached?
Uber’s notice says a third-party provider’s compromised credentials were used to access Uber data connected to the provider. It does not describe an intrusion into Uber’s own systems, based on the wording of the notice.
What help is Uber offering?
Uber is offering affected people credit monitoring and fraud assistance through Cyberscout, a TransUnion company. The notice says enrollment must occur within 90 days of the letter date; recipients should check their letter for instructions.
Has Uber found evidence of identity fraud?
Uber says it has not identified misuse of the data to date. That describes the company’s findings when it issued the notice; the cited material does not say whether later misuse has occurred.
Source: ThorstenMeyerAI.com
