🔍 Read the full analysis: How Drivers Can Navigate The Uber License Data Breach on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Uber has begun notifying people in the United States whose personal information was accessed through a third-party vendor, Fireworks AI. Breach notices reviewed by TechCrunch say the affected information includes driver’s license data, but Uber has not given a national total. Recipients can use free credit monitoring and fraud assistance, but must enroll within 90 days of their letter date.
Uber has begun notifying U.S. residents that personal information was accessed through its third-party vendor Fireworks AI, with breach notices reviewed by TechCrunch identifying driver’s license information among the data taken. Uber says about 1,873 Rhode Island residents were affected; additional state filings and notices reported by TechCrunch put the known count in Massachusetts and South Carolina at 2,567 and 3,430, respectively. The company has not disclosed a national total, and affected people should check their individual letter for the specific information involved.
In a notice filed with the California attorney general, Uber said a service provider told it on October 9 that an unauthorized party had compromised the provider’s internal credentials and used them to access Uber’s account with that provider. Uber’s investigation found on October 13 that Uber data connected to the service had been accessed. The filing lists October 7 as the breach date and November 10 as the reporting date.
Uber’s public sample letter does not identify the vendor or specify the data affected; the data field is left blank to be filled in for each recipient. TechCrunch reported that notices it reviewed list driver’s license information. Uber confirmed to the outlet that the incident involved Fireworks AI, which had access to some Uber data. The company says it has not identified any misuse of recipients’ information to date.
Uber’s notice says approximately 1,873 Rhode Island residents were affected. TechCrunch reported figures of 2,567 in Massachusetts and 3,430 in South Carolina, for 7,870 across those three states. That is a count based on those reported state figures, not a national estimate. TechCrunch also reported that an Illinois filing listed driver’s license information but said the number of affected people was pending, and that California drivers were notified without a count being disclosed.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
Steps Drivers Can Take Now
The possible exposure of driver’s license information matters because it is identifying data that recipients may need to watch for in suspicious activity or attempts to use their identity. The available notices do not establish that anyone has misused the information, and Uber says it has found no misuse to date. That statement describes what the company has identified so far; it is not proof that misuse can never occur.
Uber is offering affected people free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must occur within 90 days of the date on the letter. Drivers should use the instructions in their own notice, check which data it says was involved, and retain the letter and enrollment details. These steps provide a way to access the offered support while the scope of the incident remains incomplete.
People who receive a notice can also watch their financial and account activity and be cautious about unexpected messages that claim to be about the breach. They should not assume every Uber driver was affected: Uber has not published a nationwide count, and the notice is the source that specifies what information was linked to an individual recipient.
Products Worth Considering
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Cypress Green
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
As an affiliate, we earn on qualifying purchases.
How the Vendor Incident Reached Uber
The incident was reported at a third-party service provider, not described in Uber’s filing as an intrusion into Uber’s own systems. Uber said it severed its data connections with the provider after receiving the alert and opened an investigation. Its account says the compromised credentials were used to access Uber data held in connection with that service.
Fireworks AI operates a platform for running and customizing open AI models for businesses. In security bulletins, the company said it identified unauthorized use of internal credentials on October 6, Pacific time. It reported that an unauthorized party accessed environment variables used in evaluation jobs in a limited number of customer accounts, and said it began notifying affected customers on October 7. On the evening of October 9, it notified the customers it had identified and published its first bulletin.
Fireworks later expanded its account of potential effects. In an update last revised November 9, it reported impacts to account and billing information and said a limited set of accounts may have had secrets, datasets and incomplete models affected. The company said evidence linked the activity to a financially motivated group seeking to sell unauthorized access to large language models, a practice sometimes called “LLMJacking.” TechCrunch reported that no known group had claimed the theft. These vendor-wide statements do not establish which Fireworks systems held Uber’s driver information.
““an unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.””
— Uber’s security incident notice
What Uber Has Not Disclosed
The national number of affected people is unknown. Uber has not said how many customers or drivers it is notifying. State figures provide only partial counts, and Illinois’ reported filing left the number pending. The figures available publicly do not establish how many people were affected across all states.
The specific data involved also varies by recipient. Uber’s public sample letter leaves that information blank, while TechCrunch said notices it reviewed included driver’s license information. Recipients need to read their own letters to learn which information was associated with them. Uber has not publicly identified the Fireworks system that held the data or explained how the driver’s license information was stored there.
It also remains unclear whether the accessed information has been misused. Uber says it has not identified misuse to date, while Fireworks’ account of the incident describes potential impacts across a limited set of customer accounts. Neither company’s public statements establish that every category Fireworks listed was present in Uber’s account or accessed in this incident.
Notices and State Counts Continue
People who receive a notice should follow its enrollment instructions and note its date: the free Cyberscout monitoring and fraud assistance offer has a 90-day enrollment window. The letter also provides the best available account of what personal information Uber says was involved for that recipient.
Further state filings or company updates may add to the reported figures and clarify the data involved, but no national total has been announced. Uber and Fireworks have not publicly described a further timetable for releasing details. Until they do, the confirmed public picture remains limited to state-specific counts, the companies’ accounts of the vendor incident, and the information in each recipient’s notice.
Key Questions
What happened to Uber drivers’ information?
Uber says a third-party provider’s compromised internal credentials were used to access Uber data associated with the provider. Uber identified the vendor as Fireworks AI to TechCrunch. Notices reviewed by TechCrunch say the affected information includes driver’s license data.
How many people were affected?
Uber reported about 1,873 Rhode Island residents. TechCrunch reported 2,567 people in Massachusetts and 3,430 in South Carolina. There is no published national total, and the three-state sum does not represent the full scope of the incident.
How can I find out which of my information was involved?
Check the individual notice from Uber. Its public sample letter leaves the affected-data field blank, so the recipient’s letter is the document that identifies the information associated with that person.
Does Uber say the data has been misused?
Uber says it has not identified any misuse to date. That is the company’s current finding; the public information does not establish whether misuse will be found later.
What support is available to people who receive a letter?
Uber is offering free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. The notice says enrollment must be completed within 90 days of the letter date; recipients should follow the instructions in their own letter.
Source: ThorstenMeyerAI.com
