🔍 Read the full analysis: What Uber Drivers Need To Know About The AI Vendor Data Breach on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Uber has begun notifying people whose information was accessed after an attacker used compromised credentials at its AI vendor, Fireworks AI. TechCrunch reports that some notices list driver’s license information, but Uber has not disclosed a national total or how many drivers were affected. Recipients can enroll in free credit monitoring and fraud assistance within 90 days of their letter date.
Uber is notifying people whose personal information was accessed through a compromised account at its vendor Fireworks AI, after the company says an unauthorized party used the vendor’s internal credentials to reach Uber data. Notices reviewed by TechCrunch say the affected information includes driver’s license details, though the number of Uber drivers affected nationwide has not been disclosed.
Uber’s notice, filed with the California attorney general and dated November 10, 2026, says a service provider told Uber on October 9 that an unauthorized third party had compromised its internal credentials and used them to access Uber’s account with the provider. Uber says its investigation found on October 13 that the attacker had accessed Uber data connected to the service provider. The filing lists October 7 as the breach date.
The public sample letter does not identify the vendor or specify the affected data; that information is left blank to be filled in for each recipient. An Uber spokesperson confirmed to TechCrunch that the vendor was Fireworks AI, which had access to some Uber data. TechCrunch says breach notices it reviewed identify driver’s license information among the data taken. Recipients will need to consult their own letter to learn which personal information was involved in their case.
Uber says it immediately severed data connections with the provider after being alerted and began an investigation. Its letter offers free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must be completed within 90 days of the date on the recipient’s letter. Uber also says it has not identified any misuse of recipients’ data to date.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
What Drivers Should Check Now
The incident matters because drivers may have had sensitive identity information exposed through a company they did not choose or deal with directly. A driver’s license number can be useful to criminals attempting identity fraud, even though Uber says it has not identified misuse so far. The precise risk depends on the information listed in each person’s notice.
People who receive a letter should read its data field, note the letter date and follow the stated enrollment instructions for the 90-day monitoring window. Credit monitoring and fraud assistance are available without charge through the service named in the notice. These services do not establish that fraud has occurred; they provide a way to monitor for suspicious activity and seek help if a problem appears.
The breach also highlights a practical issue for workers whose information is handled by platforms: data exposure can occur at a vendor rather than in the company’s own systems. Uber’s account describes access through its account with a service provider, not an intrusion into Uber’s systems. That distinction identifies where the reported credential compromise occurred, but it does not reduce the need for affected people to check exactly what was exposed.
Products Worth Considering
eufy E25 Robot Vacuum and Mop with HydroJet Roller Mop, 20,000 Pa Suction
Roborock Q7 L5 Robot Vacuum and Mop Combo
Dyson V8 Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
How the Vendor Breach Reached Uber
Fireworks AI provides tools for businesses to run and customize open artificial-intelligence models. The company’s security bulletins say it identified unauthorized use of internal credentials on October 6, Pacific time. Fireworks reported that an unauthorized party accessed environment variables used in evaluation jobs in a limited number of customer accounts, and said it began notifying affected customers on October 7.
Fireworks’ timeline broadly matches Uber’s filing: Uber identifies October 7 as the breach date and says the service provider notified it on October 9. Fireworks’ later bulletin, revised November 9, reported impacts to account and billing information and said a limited set of accounts also had impacts to secrets, datasets and incomplete models. The bulletins do not identify Uber or say which Fireworks system held the Uber data.
Fireworks said evidence links the activity to a financially motivated cybercriminal group seeking to sell access to large language models, a practice described as “LLMJacking.” TechCrunch reported that no known group had claimed the theft. Those details concern Fireworks’ broader incident; they do not establish that Uber driver information was sold or misused.
““An unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.””
— Uber, in its notice to affected people
What the Notices Do Not Establish
The national number of affected people is unknown. Uber has not said how many customers or drivers it is notifying. State filings and notices reported by TechCrunch offer partial counts: about 1,873 Rhode Island residents, 2,567 in Massachusetts and 3,430 in South Carolina. Together, those state figures total 7,870 people, but they are not a nationwide estimate. An Illinois filing reportedly says driver’s license information was involved while leaving the number affected pending; California notices were also reported, without a count.
The public sample letter does not identify the specific data involved for each person, and the companies have not said which Fireworks system contained Uber’s data. It is also not clear whether the exposed information was accessed or misused beyond the access described in the notices. Uber says it has found no misuse to date; that statement does not resolve what may be learned as its inquiry continues.
More Counts and Notices May Follow
Affected people should use their own notice to confirm the data involved and the deadline for enrolling in Cyberscout monitoring and fraud assistance. State disclosures may add further counts as filings are updated, but neither Uber nor the cited reports provide a complete national tally at this stage.
Uber says it cut off the vendor’s data connections and investigated the access. The companies have not publicly detailed which specific Uber data was stored in the affected Fireworks environment or described any further findings about misuse. Those points, along with the number of affected drivers, remain the main developments to watch.
Key Questions
What happened to Uber drivers’ information?
Uber says an attacker used compromised internal credentials at its vendor, Fireworks AI, to access Uber data connected to the vendor. TechCrunch reports that notices to affected people include driver’s license information. The precise data involved may differ by recipient, so the individual notice is the best source for that person’s details.
How many Uber drivers were affected?
Uber has not released a nationwide total or said how many drivers it is notifying. State figures reported so far cover residents in Rhode Island, Massachusetts and South Carolina, with other state counts incomplete or undisclosed. The figures do not establish the full number affected.
Was Uber itself hacked?
Uber’s notice describes an attacker using compromised credentials at a service provider to access Uber’s account with that provider. It does not describe an intrusion into Uber’s own systems.
What should someone who receives a letter do?
Read the notice to see which information was involved and follow its enrollment instructions for free credit monitoring and fraud assistance through Cyberscout. Uber says enrollment must take place within 90 days of the letter date. Uber has reported no identified misuse of the data to date.
Source: ThorstenMeyerAI.com
