🔍 Read the full analysis: AI Vendor Breach Hits Uber Driver Data: What To Do Now on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Uber says an unauthorized party used compromised credentials at its vendor Fireworks AI to access Uber data. Notices reported by TechCrunch say driver’s license information was among the data involved, but Uber’s public sample letter does not specify what information was exposed for each recipient. Affected people should check their notice for the data involved and enroll in the offered assistance within 90 days of the letter date.
Uber is notifying people whose personal information was accessed through a third-party vendor, Fireworks AI, after an unauthorized party used compromised vendor credentials to reach data connected to Uber. Notices reviewed by TechCrunch say the information includes driver’s license details, but Uber’s public sample letter leaves the specific data field blank, so recipients must consult their own letters to learn what information was involved.
In a notice filed with the California attorney general and dated November 10, 2026, Uber said a service provider told it on October 9 that an unauthorized party had compromised the provider’s internal credentials and used them to access Uber’s account with the provider. Uber said it severed data connections with the vendor and began investigating. By October 13, the investigation had found that Uber data connected to the provider had been accessed.
Uber’s notice does not name the vendor. An Uber spokesperson identified it as Fireworks.ai in a statement to TechCrunch, saying the company had access to some Uber data. A Fireworks spokesperson also told TechCrunch that the company found unauthorized access to some of its systems that affected customer data. The available notice describes access through a service provider; it does not say that the attacker entered Uber’s own systems.
The public sample letter does not identify the affected data, but TechCrunch reported that breach notices it reviewed included driver’s license information. Uber said it has not identified any misuse of the recipient’s data to date. The company is offering free credit monitoring and fraud assistance through Cyberscout, a TransUnion company; the letter says recipients must enroll within 90 days of its date.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
What Drivers Should Check Now
The exposure matters because driver’s license information can be used in identity-related fraud, while the number and types of people affected nationally remain unknown. Drivers should first read their individual Uber notice: the public sample is a template and does not establish which specific information was accessed for every person.
People who receive a letter can follow its instructions to enroll in the offered monitoring and fraud assistance before the 90-day deadline. They should keep the letter and watch for unexpected account activity or communications that request personal details. These are practical precautions, not evidence that anyone’s information has already been misused. Uber said it had found no misuse as of its notice.
Popular right now
De’Longhi Classic Matte Black Espresso Machine with Milk Frother
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Cypress Green
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
As an affiliate, we earn on qualifying purchases.
How the Vendor Breach Reached Uber Data
Fireworks provides a platform businesses use to run and customize open AI models. Its security bulletins say the company identified unauthorized use of internal credentials on October 6, Pacific time. The company said an unauthorized party accessed environment variables used in evaluation jobs in a limited number of customer accounts, and that it began notifying affected customers on October 7.
Fireworks’ account, as updated November 9, also describes effects involving account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. The company said evidence linked the activity to a financially motivated group seeking to sell unauthorized access to large language models, a practice it called “LLMJacking.” That is Fireworks’ assessment; TechCrunch reported that no known group had claimed the theft.
Uber’s filing lists October 7, 2026, as the breach date and says the vendor notified it on October 9. State disclosures offer partial counts: Uber’s notice cites about 1,873 Rhode Island residents, while TechCrunch reported 2,567 in Massachusetts and 3,430 in South Carolina. Those reported figures total 7,870 across three states, but do not establish the national number of affected people.
“Uber has “not identified any misuse of your data to date.””
— Uber, in its notice to affected people
What the Notices Do Not Specify
The national total is unknown. Uber has not publicly stated how many people it is notifying. The available state figures are partial: TechCrunch reported that an Illinois filing listed driver’s license information but left the number affected pending, and that Uber notified California drivers without stating a count.
It is also not clear which specific information was accessed for each recipient, which Fireworks system held the Uber data, or how the attacker used the credentials beyond accessing data. The public sample letter leaves the affected-data field as a placeholder, and Fireworks’ bulletins do not name Uber. The companies have not publicly provided a full account of the data flow or confirmed any subsequent misuse.
Further Notices and Counts Expected
Recipients should use their own letter to identify the information involved and follow the enrollment instructions and deadline. Uber’s notice says letters are being sent to people whose personal information was among the accessed data. State filings may add further counts, but no complete public total has been provided.
Further details may come from Uber, Fireworks or additional regulatory disclosures, including information about the affected systems, the scope of the notifications and whether investigators identify misuse. Until then, the confirmed picture remains limited to the vendor credential compromise, access to Uber data connected to the vendor and the partial state-level counts.
Key Questions
Was Uber’s own system breached?
Uber’s notice describes an unauthorized party using a vendor’s compromised credentials to access Uber data connected to the service provider. It does not describe an intrusion into Uber’s own systems.
What information was exposed?
TechCrunch reported that notices it reviewed included driver’s license information. Uber’s public sample letter leaves the affected-data field blank, so recipients should check their individual notice for details about their information.
How many people were affected?
Uber has not announced a national total. Reported state figures include about 1,873 Rhode Island residents in Uber’s filing, plus 2,567 in Massachusetts and 3,430 in South Carolina, according to TechCrunch. Those are partial counts.
What should someone who received a letter do?
Read the letter to see what information it identifies and follow its instructions for free credit monitoring and fraud assistance through Cyberscout. Enrollment must occur within 90 days of the letter date, according to Uber’s notice.
Has Uber reported misuse of the data?
Uber said it had not identified any misuse as of its notice. That statement reflects the company’s findings at that time and does not establish whether misuse could occur later.
Source: ThorstenMeyerAI.com
