🔍 Read the full analysis: AI Vendor Data Breach And Uber: What Drivers Should Know on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Uber is notifying people whose information was accessed after a security incident at third-party AI provider Fireworks.ai, which had access to some Uber data. Breach notices reported by TechCrunch say the information includes driver’s license details, but Uber’s public sample letter does not specify the data for each recipient. The affected national population remains unknown.
Uber is notifying people whose personal information was accessed through a third-party provider, Fireworks.ai, after the AI platform experienced a security incident in October. Notices reviewed by TechCrunch say the exposed information includes driver’s license details, while Uber’s public sample letter leaves the specific data field blank, making each recipient’s own letter the clearest available account of what was involved.
In a notice filed with the California attorney general and dated November 10, 2026, Uber said a service provider told the company on October 9 that an unauthorized party had compromised the provider’s internal credentials and used them to access Uber’s account with that provider. Uber said it severed data connections with the provider and began an investigation. The company determined on October 13 that Uber data connected to the service provider had been accessed.
The filing does not name the provider or identify the information affected in its public sample letter. An Uber spokesperson told TechCrunch the incident involved Fireworks.ai, which had access to some Uber data. A Fireworks spokesperson separately confirmed to TechCrunch that unauthorized access to some of its systems affected customer data. Uber’s account describes access through a vendor relationship; it does not say that the incident involved an intrusion into Uber’s own systems.
State disclosures provide partial counts, not a national total. Uber’s notice says about 1,873 Rhode Island residents were affected. TechCrunch reported notices listing 2,567 people in Massachusetts and 3,430 in South Carolina, and said an Illinois filing identified driver’s license information while leaving the number pending. Uber has not publicly said how many people or drivers nationwide received notices.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
What Drivers Should Do With Their Notice
For affected drivers, the immediate practical issue is determining which personal information was accessed. The public sample letter does not give one answer for every recipient: the data field is left for information specific to the person receiving it. Drivers should read their own notice rather than assume that every recipient’s data exposure was identical. TechCrunch’s reporting that some notices include license information is a reported detail, not a complete list of data involved for all people.
Uber says affected people can use free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must take place within 90 days of the date on the recipient’s letter. People who received a notice should check its instructions and deadline and use the contact information supplied in it if they have questions. Uber also said it had not identified misuse of the affected data to date; that statement describes the company’s findings at the time of the notice, not a guarantee about future misuse.
The incident also matters beyond the individuals named in notices because it shows how personal information can be affected through a company’s vendor relationship. Uber users and drivers do not choose every service provider that may handle company data. In this case, the confirmed chain described by Uber runs from compromised credentials at a service provider to access to Uber data associated with that provider.
Products Worth Considering
Jackery Explorer 300 Portable Power Station, 292Wh
Samsung Odyssey G7 G75F 40-Inch WUHD Curved Gaming Monitor
Apple Watch Series 10 GPS 46mm with Silver Aluminum Case and Blue Cloud Sport Loop
As an affiliate, we earn on qualifying purchases.
How the Fireworks Incident Reached Uber
Fireworks operates a platform businesses use to run and customize open AI models. Its own security bulletins say it identified unauthorized use of internal credentials on October 6, Pacific time, and that an unauthorized party accessed environment variables used in evaluation jobs for a limited number of customer accounts. Fireworks said it began notifying affected customers on October 7 and, on the evening of October 9, notified the affected customers it had identified and published its first bulletin.
Those dates broadly align with Uber’s account: the California filing lists October 7 as the breach date, while Uber says the provider alerted it on October 9 and its investigation found access to Uber data on October 13. The companies’ public statements do not identify which Fireworks system held the Uber data or explain precisely how that data was stored or accessed.
Fireworks’ bulletin, last revised November 9, expanded its description of possible effects to include account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. The company said evidence links the activity to a financially motivated group seeking to sell tokens obtained through unauthorized access to large language models, a practice known as LLMJacking. That is Fireworks’ assessment; TechCrunch reported that no known group had claimed the theft. The available material does not establish that every category Fireworks listed was involved in the Uber-related data.
“An unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.”
— Uber, in its sample security incident notice
The Missing National Exposure Count
The total number of affected people is not public. The figures available cover only certain state filings or notices reported by TechCrunch. Uber has not disclosed a nationwide count or said how many drivers specifically were notified. The reported figures for Rhode Island, Massachusetts and South Carolina do not establish the full scale, and Illinois’ count was still pending in the reporting cited here.
It also remains unclear exactly which data fields were accessed for each person, which Fireworks system held the Uber information, and how the compromised credentials enabled access to that information. Uber’s public sample notice leaves the affected-data field blank, so the details may vary by recipient. Neither company has publicly provided a complete account of the data flow or a person-by-person description.
Uber said it had not found evidence of data misuse at the time of its notice. That does not settle whether information could be misused later. Fireworks’ account of a financially motivated group is the company’s assessment, and public reporting says no known group has claimed responsibility.
Notices and State Filings to Follow
People who receive a letter should follow the instructions in that notice, including the 90-day enrollment window for the credit monitoring and fraud assistance offered through Cyberscout. The letter is the source Uber has provided for the specific information associated with each recipient. Drivers who have not received a notice should not infer from the partial state totals that they were or were not affected.
Further state filings or company updates may clarify the number of people involved and what data was accessed. Uber has not announced a national total or a timetable for additional disclosure in the material cited here. Until more information is released, the scale and the full data scope remain unresolved.
Key Questions
Was Uber itself hacked?
Uber’s notice says a third-party provider’s compromised internal credentials were used to access Uber’s account with that provider. It describes access to Uber data connected to the vendor, not an intrusion into Uber’s own systems.
Which vendor was involved?
Uber’s public notice does not name the provider. An Uber spokesperson told TechCrunch that it was Fireworks.ai, and Fireworks confirmed to the publication that unauthorized access to some of its systems affected customer data.
What information was exposed?
TechCrunch reported that breach notices include driver’s license information. Uber’s public sample letter leaves the affected-data field blank for each recipient, so people should check their own notice for the information associated with them.
How many Uber drivers were affected?
Uber has not disclosed a national total or a driver-specific count. The available state figures are partial, and the Illinois count was reported as pending.
What should someone who received a letter do?
Read the notice for the data involved and follow its instructions. Uber is offering credit monitoring and fraud assistance through Cyberscout, with enrollment required within 90 days of the letter date.
Source: ThorstenMeyerAI.com
