🔍 Read the full analysis: Could Your Uber Driver License Data Be Affected By An AI Vendor Breach? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Uber says a third-party vendor, Fireworks.ai, was accessed using compromised internal credentials, and information connected to Uber’s account was affected. Breach notices reviewed by TechCrunch say the exposed data includes driver’s license information, but Uber has not disclosed a national count of affected people. Uber says it has not identified misuse and is offering eligible recipients free credit monitoring and fraud assistance.
Uber has begun sending notices to people whose personal information was accessed through a breach at its third-party vendor Fireworks.ai, an AI model platform. Notices reviewed by TechCrunch say the affected information includes driver’s license data, although Uber has not provided a national count of affected people.
In a notice filed with California’s attorney general and dated November 10, 2026, Uber said a service provider told the company on October 9 that an unauthorized party had compromised the provider’s internal credentials and used them to access Uber’s account with that provider. Uber said its investigation found on October 13 that Uber data connected to the provider had been accessed. The filing lists October 7 as the breach date.
The California filing does not name the vendor or specify which information was involved. An Uber spokesperson identified the vendor as Fireworks.ai in a statement to TechCrunch, saying it had access to some Uber data. The public sample notice leaves the affected-data field blank for recipient-specific details. TechCrunch reported that notices it reviewed include driver’s license information.
Uber’s notice says about 1,873 Rhode Island residents were affected. TechCrunch reported figures of 2,567 people in Massachusetts and 3,430 in South Carolina, and said an Illinois filing identified driver’s license information while leaving the affected-person count pending. Uber also notified drivers in California, but the count there was not reported. These state figures do not establish a national total.
Uber said it has not identified any misuse of recipients’ data to date. The company is offering free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. The notice says enrollment must be completed within 90 days of the letter date; recipients should check their own notice for the specific deadline and instructions.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
Why License Data Raises Concern
A driver’s license number is sensitive identifying information. If exposed, it can create risks of identity-related fraud, even when a company has not found evidence of misuse. Uber’s statement that it has identified no misuse is a report about its investigation so far, not a guarantee that information cannot be used later.
The incident also shows how a company’s data can be affected through a vendor relationship without a reported intrusion into the company’s own systems. Uber’s notice describes access to its account with a service provider and to Uber data connected to that provider. It does not describe an intrusion into Uber’s internal systems.
For affected drivers, the practical next step is to read the letter carefully to see which information was involved and how to enroll in the offered services. Because the known numbers come from separate state filings and reporting, the total reach remains uncertain.
Products Worth Considering
Amazon Kindle Paperwhite (12th Generation, 2024), 16GB, 7-Inch Display, Raspberry
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
As an affiliate, we earn on qualifying purchases.
How the Vendor Breach Reached Uber
Fireworks.ai provides businesses with a platform to run and customize open AI models. Its own security bulletins say it identified an incident on October 6, Pacific time, involving unauthorized use of internal Fireworks credentials. The company said an unauthorized party accessed environment variables used in evaluation jobs in a limited number of customer accounts. Fireworks said it began notifying affected customers on October 7 and notified customers it had identified by the evening of October 9.
The dates in Fireworks’ account broadly align with Uber’s filing, which lists October 7 as the incident date and says a provider notified Uber on October 9. Fireworks later reported impacts to account and billing information and said a limited set of accounts had impacts to secrets, datasets, and incomplete models. Its bulletins do not name Uber or specify which Fireworks system held the Uber data.
Fireworks said evidence links the activity to a financially motivated group seeking to sell unauthorized access to large language models, a practice known as LLM jacking. That is the company’s assessment; TechCrunch reported that no known group had claimed responsibility. The available information does not establish that Uber driver data was used for that activity or that it was misused.
““We have not identified any misuse of your data to date.””
— Uber, in its notice to affected people
Who Was Affected and What Data
The national number of affected people is unknown. Uber has not disclosed how many customers or drivers received notices. Available counts cover some state filings and reports, while the Illinois count was pending and the California figure was not provided in the reporting cited here.
The public sample letter does not identify the recipient-specific data involved; that field is completed for each person. The notice sent to an individual is therefore the clearest available source for what information that person’s record contained. The companies have not publicly specified which Fireworks system held Uber data or how many Uber records were accessed.
Uber says it has found no misuse to date. The source material does not establish whether any data was copied, offered for sale, or used for fraud. It also does not provide a final account of the investigation or explain whether additional people or data categories will be identified.
What Notices and Investigations May Reveal
People who receive an Uber notice should review its recipient-specific data field and follow the enrollment directions if they want to use the offered monitoring and fraud assistance. The stated enrollment period is 90 days from the letter date; recipients should rely on the deadline printed in their own notice.
Further details may come from additional state filings, updated company notices, or reporting as Uber and Fireworks continue their investigations. The companies have not announced a national count or a date for a final update. Until they provide one, the scale of the incident and the full range of affected information remain unsettled.
Key Questions
Was Uber itself hacked?
The notice describes compromised credentials at a service provider being used to access Uber’s account with that provider. It does not describe an intrusion into Uber’s own systems. Uber identified the provider as Fireworks.ai in a statement to TechCrunch.
Was driver’s license information exposed?
TechCrunch reported that breach notices it reviewed list driver’s license information. Uber’s public sample notice leaves the data field blank for details specific to each recipient, so people who receive a letter should check what their own notice says.
How many Uber drivers were affected?
Uber has not disclosed a national total. Available figures include about 1,873 Rhode Island residents in Uber’s filing, along with counts reported by TechCrunch for Massachusetts and South Carolina. Other state counts are missing or pending.
What support is Uber offering?
Uber’s notice offers free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. The notice says recipients must enroll within 90 days of its date; check the letter for instructions and the applicable deadline.
Has Uber found evidence that the data was misused?
Uber said it had not identified misuse to date. That statement does not establish whether data was copied or rule out future misuse; the available information does not provide a final investigation finding.
Source: ThorstenMeyerAI.com
