🔍 Read the full analysis: Uber License Data Theft: How Drivers Can Take Their Next Steps on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Uber is notifying people whose personal information was accessed through its vendor Fireworks AI after the vendor reported compromised internal credentials. Notices reviewed by TechCrunch say driver’s license information was among the data affected, but Uber has not provided a national total. Recipients can enroll in free credit monitoring and fraud assistance within 90 days of the date on their letter.
Uber is notifying people whose personal information was accessed through Fireworks AI, a third-party vendor, after an unauthorized party used compromised vendor credentials to reach data linked to Uber’s account. Notices reviewed by TechCrunch say the exposed information includes driver’s license data; Uber has not disclosed a national count of affected people.
In a notice filed with the California attorney general and dated November 10, 2026, Uber said a service provider told the company on October 9 that an unauthorized third party had compromised the provider’s internal credentials and used them to access Uber’s account with the provider. Uber said its investigation found on October 13 that Uber data connected to the service had been accessed. The filing lists October 7 as the breach date.
The regulator notice does not name the vendor or specify which personal information was involved. Uber identified Fireworks AI to TechCrunch as the provider, saying it had access to some Uber data. A Fireworks spokesperson also told TechCrunch that the company had identified unauthorized access to some of its systems affecting customer data. The public sample notice leaves the affected-data field blank; the recipient’s individual letter is the document that specifies what information was involved.
Numbers reported so far come from state notices, not a confirmed nationwide tally. Uber’s notice says about 1,873 Rhode Island residents were affected. TechCrunch reported notices listing 2,567 people in Massachusetts and 3,430 in South Carolina. Illinois filings identify driver’s license information but, according to TechCrunch, leave the number of affected people pending. Uber has not said how many drivers it is notifying overall.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
What Drivers Should Check Now
The notices matter because driver’s license information can be misused for identity fraud, and recipients may need to take protective steps even though Uber says it has not found misuse to date. Anyone who receives a letter should read its individualized data description rather than assume every person’s information was affected in the same way.
Uber says recipients can access free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must be completed within 90 days of the date on the letter. Drivers should check the letter for the enrollment instructions and deadline, keep a copy, and use the listed service directly. The source material does not specify additional steps Uber recommends for all recipients, so drivers should avoid treating generic advice as a company instruction.
The incident also illustrates a risk of vendor access: information held outside a company’s own systems can still be exposed through a supplier account. Uber’s account describes access through the service provider, not an intrusion into Uber’s own systems. That distinction helps explain the route of exposure, but does not establish exactly where the driver data was stored or how it was accessed.
Products Worth Considering
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
Samsung Odyssey OLED G5 27-Inch QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Vendor Breach Reached Uber
Fireworks AI provides infrastructure for running and customizing open AI models for businesses. Its security bulletins say the company identified unauthorized use of internal credentials on October 6, Pacific time, and that an unauthorized third party accessed environment variables used in evaluation jobs in a limited number of customer accounts. Fireworks said it began notifying affected customers on October 7 and notified customers it had identified on October 9.
Those dates broadly align with Uber’s filing, which gives October 7 as the breach date and says a service provider alerted Uber on October 9. Uber says it cut data connections with the provider after receiving the alert and began an investigation. The company’s notice describes access to Uber’s account and data connected to the vendor; it does not say that Uber’s internal systems were breached.
In a bulletin last revised November 9, Fireworks reported impacts to account and billing information and said a limited set of accounts also had impacts involving secrets, datasets, and incomplete models. The company said evidence linked the activity to a financially motivated group seeking to sell unauthorized access to large language models, a practice called “LLMJacking.” TechCrunch reported that no known group had claimed the theft. Those statements concern Fireworks’ broader incident; neither company has publicly identified which Fireworks system held the Uber-related driver data.
“Uber has “not identified any misuse of your data to date”.”
— Uber, in the security notice sent to affected people
The Unreported National Toll
The total number of affected people is unknown. Uber has not provided a national count of customers or drivers receiving notices. State filings disclose figures at different times and with different levels of detail; the available Rhode Island, Massachusetts, and South Carolina numbers should not be read as a complete total.
It is also unclear which specific driver records were involved in each case, how the information was held within Fireworks’ systems, and whether people beyond those identified in the current state notices were affected. The sample letter’s data field is blank, while the notice sent to each person is personalized. Uber says it has found no misuse so far, but the material does not establish whether that assessment will change.
More Notices and State Filings
For now, affected drivers should use their individual Uber letter to confirm which information was involved and follow its Cyberscout enrollment instructions before the 90-day deadline. People who have not received a notice cannot determine from the public sample alone whether their information was included; Uber has not published a complete recipient count.
Further details may emerge through additional state filings or updated statements from Uber and Fireworks. The next points to watch are whether the companies disclose a broader affected-person total, clarify which data and systems were involved, or report evidence of misuse. No further public disclosure date or specific next milestone is given in the supplied material.
Key Questions
What happened to Uber drivers’ information?
Uber says an unauthorized party used compromised credentials at a third-party service provider to access data connected to Uber’s account. Uber identified that provider as Fireworks AI to TechCrunch. Notices reviewed by TechCrunch say driver’s license information was among the data involved.
How can I find out whether my driver’s license information was affected?
Check the individualized Uber security notice. The public sample notice leaves the affected-data field blank, so it does not show what information was involved for a particular recipient.
What support is Uber offering?
Uber says recipients can enroll in free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must take place within 90 days of the date printed on the recipient’s letter.
How many people were affected?
A nationwide total has not been disclosed. The source material cites about 1,873 people in Rhode Island, 2,567 in Massachusetts, and 3,430 in South Carolina; other state counts are incomplete or not provided.
Has Uber reported that anyone’s information was misused?
Uber said it had not identified any misuse to date in its notice. That statement reflects the company’s findings at the time and does not establish whether misuse could be detected later.
Source: ThorstenMeyerAI.com
