🔍 Read the full analysis: Uber’s AI Vendor Breach: How Drivers Can Review Their Data Risks on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Uber has begun notifying people whose information was accessed through an account at Fireworks AI, a third-party vendor. TechCrunch reports that notices include driver’s license information; Uber’s public sample notice does not specify the data for each recipient. The known state figures are incomplete, and Uber says it has identified no misuse so far.
Uber has started notifying people whose personal information was accessed through its account with Fireworks AI, a third-party AI platform, after the vendor reported compromised credentials in October. TechCrunch reports that some notices identify driver’s license information among the data taken, but Uber’s public sample letter leaves the data field blank; recipients need to check their own letters to learn what information was involved.
In a breach notice filed with the California attorney general and dated November 10, Uber said a service provider told it on October 9 that an unauthorized party had compromised the provider’s internal credentials and used them to access Uber’s account there. Uber said it severed data connections with the provider and began investigating. By October 13, its investigation had found that Uber data connected to the service provider had been accessed.
The regulatory notice does not name the provider. An Uber spokesperson identified it as Fireworks.ai in a statement to TechCrunch, saying the vendor “had access to some Uber data.” A Fireworks spokesperson told the outlet the company had found unauthorized access to some of its systems that affected customer data. The notice describes access through Uber’s account with the provider, not an intrusion into Uber’s own systems.
The public sample letter does not list the affected data, and the field is intended to be filled in for each recipient. TechCrunch reports that breach notices it reviewed include driver’s license information. Uber says it has not identified any misuse of the affected person’s data to date. Its letter offers free credit monitoring and fraud assistance through Cyberscout, a TransUnion company; recipients must enroll within 90 days of the letter date.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
What Drivers Should Check Now
The breach puts drivers’ personal information at risk through a vendor relationship they may not have known about or chosen. If a notice identifies a driver’s license number or other sensitive information, that person can use the letter to determine which data may need closer monitoring. The fact that Uber has not identified misuse is a statement about what the company has found so far, not proof that exposed information cannot be used later.
Recipients should read the notice rather than assume every person’s information was the same. They can review the listed data, the enrollment deadline and the contact details for the offered credit monitoring and fraud assistance. The reported involvement of license information also gives affected drivers a reason to follow the instructions in their notice and watch for suspicious activity connected to the specific data named there. The source material does not provide a separate procedure for replacing a license or establish that every recipient needs to do so.
The incident also shows how personal information held by an outside service can create risks for a company’s customers and workers. Uber says it cut the data connection after learning of the issue, but the information had already been accessed. For drivers, the immediate practical distinction is between a confirmed access incident and confirmed fraud: Uber reports the former and says it has not found the latter.
Popular right now
Ninja CREAMi Scoop & Swirl 13-in-1 Ice Cream and Soft Serve Maker (NC701)
Ninja Foodi DZ201 8-Quart DualZone 6-in-1 Air Fryer
Dyson V15 Detect Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
How the Vendor Incident Reached Uber
Fireworks provides a platform businesses use to run and customize open AI models. In a security bulletin, the company said it identified unauthorized use of internal credentials on October 6, Pacific time, and that a third party accessed environment variables used in evaluation jobs in a limited number of customer accounts. Fireworks said it began notifying affected customers on October 7 and notified customers it had identified on the evening of October 9, Pacific time.
Those dates broadly align with Uber’s account: its filing lists October 7 as the breach date, while Uber says its service provider notified it on October 9. Fireworks’ update, last revised November 9, reported effects involving account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. Its bulletins do not name Uber or identify which Fireworks system held the Uber data.
Fireworks said evidence linked the activity to a financially motivated group seeking to sell access to large language models, a practice called “LLMJacking.” That is the vendor’s account of the suspected motive. TechCrunch reported that no known group had claimed the theft. The available material does not establish that Uber driver information was used for that purpose.
““An unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.””
— Uber, in its notice to affected individuals
The Count and Data Are Incomplete
A national total is not available. Uber’s notice says about 1,873 Rhode Island residents were affected. TechCrunch reported figures of 2,567 in Massachusetts and 3,430 in South Carolina, or 7,870 across those three states when added together. That is a count from three state figures, not a nationwide estimate. TechCrunch also reported that an Illinois filing said the number affected was pending, and that Uber notified California drivers without giving a total.
Uber has not said how many people overall, or how many drivers, received notices, according to TechCrunch. The public sample letter also does not say which information applied to each person; that detail is specific to the recipient’s letter. The source material does not establish whether every affected person is a driver, whether additional states will report figures, or whether any data has been misused.
It is also unclear which Fireworks system contained the Uber information and how the accessed data was connected to the vendor’s reported exposure of other account materials. Neither company has publicly provided those technical details in the material available here. Fireworks’ description of suspected criminal activity is not confirmation that the group accessed or used Uber driver data.
Notice Deadlines and Further Filings
People who receive an Uber letter should use it to identify the specific data involved and check the stated deadline for enrolling in the offered service. The notice says enrollment in Cyberscout’s free monitoring and fraud assistance must take place within 90 days of the letter date. Recipients should rely on their individual notice for the applicable dates and instructions.
Further state filings or company statements may clarify how many people were notified and which categories of data were accessed. At present, neither Uber nor Fireworks has supplied a national count or a public account of the specific Fireworks system involved. Any updates on misuse, additional affected data or revised totals remain developing information.
Key Questions
What happened in the Uber-related breach?
A third party used compromised internal credentials at Fireworks AI to access Uber data connected to the vendor. Uber says it was notified on October 9, 2026, and found the Uber data had been accessed during its investigation.
Was driver’s license information exposed?
TechCrunch reported that notices it reviewed included driver’s license information. Uber’s public sample letter leaves the affected-data field blank, so each recipient should check their own letter for the information listed for them.
How many people were affected?
A national total has not been disclosed. The figures in the source material are about 1,873 Rhode Island residents, 2,567 in Massachusetts and 3,430 in South Carolina, with other state counts incomplete or not provided.
What should a recipient do with the notice?
Read the letter to identify the data involved and follow its enrollment instructions. Uber’s notice offers free credit monitoring and fraud assistance through Cyberscout, with enrollment required within 90 days of the letter date.
Has Uber reported identity theft or other misuse?
Uber said it had not identified misuse of the recipient’s data as of the notice. That statement does not establish that future misuse is impossible, and the source material does not report confirmed fraud tied to this incident.
Source: ThorstenMeyerAI.com
