🔍 Read the full analysis: Uber Driver Data Breach Raises Questions About License Information on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Uber is notifying people whose information was accessed through Fireworks AI, a third-party vendor, after Fireworks credentials were compromised in October. Notices reviewed by TechCrunch say driver’s license information was among the data taken, but Uber’s public sample notice does not specify the data for each recipient or provide a national count.
Uber is notifying people in the United States that their personal information was accessed through Fireworks AI, a third-party service provider, after the vendor’s internal credentials were compromised in October. Notices reviewed by TechCrunch say the exposed information includes driver’s license details, although Uber’s public sample letter leaves the specific data field blank for each recipient.
In a notice filed with the California attorney general and dated November 10, Uber said a service provider informed it on October 9 that an unauthorized party had compromised the provider’s internal credentials and used them to access Uber’s account with the provider. Uber said its investigation found on October 13 that Uber data connected to the service had been accessed. The filing lists October 7 as the breach date.
Uber’s public sample letter does not name the provider. An Uber spokesperson told TechCrunch the incident involved Fireworks.ai, which had access to some Uber data. A Fireworks spokesperson also told the outlet the company identified unauthorized access to some of its systems that affected customer data. The public letter describes access to data connected to the vendor; it does not describe an intrusion into Uber’s own systems.
State disclosures provide partial counts. Uber’s notice says about 1,873 Rhode Island residents were affected. TechCrunch reported 2,567 people in Massachusetts and 3,430 in South Carolina, for 7,870 across those three states. Illinois filings identify driver’s license information but leave the number affected pending, while Uber notified drivers in California without providing a count, according to TechCrunch. Uber has not given a national total.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
What Drivers Should Check
The reported exposure of driver’s license information matters because the document contains identifying details that people may need to protect against identity misuse. The exact information involved can vary by recipient: Uber’s sample notice says the data field is individualized, so the letter is the available source for each person’s specific exposure.
Uber says affected people can receive credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must be completed within 90 days of the date on the letter. Uber also says it has not identified misuse of the data to date. That statement reflects what the company has found so far; it does not establish that misuse cannot occur later.
Popular right now
Dyson V8 Cordless Vacuum
KitchenAid Artisan 5-Qt Tilt-Head Stand Mixer, KSM150PS, Almond Cream
Roborock Q7 M5+ Robot Vacuum and Mop
As an affiliate, we earn on qualifying purchases.
How the Vendor Incident Unfolded
Fireworks’ security bulletins say the company identified unauthorized use of internal credentials on October 6, Pacific time, and found that a third party accessed environment variables used in evaluation jobs in a limited number of customer accounts. Fireworks said it began notifying affected customers on October 7. On the evening of October 9, it notified the customers it had identified and published its first bulletin. Those dates broadly align with Uber’s account of receiving a vendor alert on October 9 and listing October 7 as the breach date.
In an update last revised on November 9, Fireworks reported effects on account and billing information and said a limited set of accounts also had impacts involving secrets, datasets and incomplete models. The company said evidence linked the activity to a financially motivated group seeking to sell access to large language models, a practice called “LLMJacking.” TechCrunch reported that no known group had claimed the theft. The bulletins do not name Uber or explain which Fireworks system contained the driver information.
““an unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.””
— Uber, in its notice to affected people
What the Notices Do Not Show
The national number of affected people remains unknown. Uber has not said how many customers or drivers it is notifying, and the state figures reported so far cover only some jurisdictions. Illinois’ affected-person count was still pending in the filing described by TechCrunch; California’s count was not provided in that report.
The public sample letter also leaves the specific data field blank, with details supplied for individual recipients. TechCrunch reports that notices it reviewed include driver’s license information, but the available material does not establish that every affected person had that same information accessed. Uber and Fireworks have not said which vendor system held the data or provided a complete account of what information was involved for all recipients. No confirmed misuse is reported by Uber to date.
Notices and State Counts Ahead
Affected people should review their individual notice to identify which information Uber says was accessed and follow its instructions for Cyberscout monitoring and fraud assistance. The enrollment window is 90 days from the letter date. People who did not receive a notice but are concerned should use Uber’s official channels to check whether they are included, rather than relying on a state total as a complete count.
Further state filings or company updates may clarify the number of people affected and the types of data involved. Uber has not announced a national figure or a date for a fuller public account, and Fireworks’ published bulletins do not identify the Uber data or system involved. Those details remain open as notifications continue.
Key Questions
What happened to Uber drivers’ information?
Uber says a third-party vendor, Fireworks AI, told it on October 9 that an unauthorized party had compromised internal credentials and accessed Uber data connected to the vendor. Notices reviewed by TechCrunch say the information included driver’s license details.
How many people were affected?
Uber has not provided a national total. The reported state counts are about 1,873 in Rhode Island, 2,567 in Massachusetts and 3,430 in South Carolina. Other state counts are missing or pending in the information described by TechCrunch.
Was Uber’s own system breached?
The notice describes access to Uber’s account with a service provider and Uber data connected to that provider. It does not describe an intrusion into Uber’s own systems.
What support does Uber offer?
Uber says affected people can enroll in credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must occur within 90 days of the letter date. The letter should identify the data involved for that recipient.
Source: ThorstenMeyerAI.com
