🔍 Read the full analysis: Why An AI Vendor Is Connected To The Uber Driver Data Breach on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Uber says a third-party vendor, Fireworks AI, was involved in a security incident that allowed an unauthorized party to access Uber data held through the vendor. Notices reported by TechCrunch say the data included driver’s license information; state filings list affected residents in several states, but Uber has not disclosed a national total.
Uber is notifying people that their personal information was accessed through Fireworks AI, a third-party vendor that had access to some Uber data. The incident involved compromised vendor credentials, according to Uber’s notice filed with California regulators; breach notices reviewed by TechCrunch say the exposed information included driver’s license data.
Uber’s notice says a service provider informed the company on October 9 that an unauthorized party had compromised the provider’s internal credentials and used them to access Uber’s account with that provider. Uber says it severed data connections with the vendor and opened an investigation. By October 13, the investigation had found that Uber data connected to the service provider had been accessed.
The public notice does not name the vendor or specify which information was involved. Uber confirmed the vendor as Fireworks.ai to TechCrunch, saying the provider had access to some Uber data. The public sample letter leaves the affected-data field blank for information specific to each recipient. TechCrunch reports that individual breach notices it reviewed identify driver’s license information among the data taken.
State filings and notices provide partial counts, not a complete total. Uber’s notice lists about 1,873 Rhode Island residents; TechCrunch reports notices covering 2,567 people in Massachusetts and 3,430 in South Carolina. Those figures add up to 7,870 across those three states, but they do not establish the national scope. TechCrunch also reported that an Illinois filing listed driver’s license information but said the affected count was pending, and that Uber notified California drivers without disclosing a number.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
Driver Data and Vendor Risk
The incident shows how personal information can be exposed through a company’s third-party service provider, rather than through a publicly described intrusion into the company’s own systems. Uber’s account says the unauthorized party used compromised credentials at the vendor to reach data associated with Uber. That distinction matters to affected drivers, but it does not make the exposure less consequential: driver’s license information can be used in attempts at identity fraud.
The known state counts are incomplete, and the public sample notice does not reveal what data applied to any individual recipient. Drivers should use their own letter to determine which information Uber says was affected. Uber says it is offering credit monitoring and fraud assistance through Cyberscout, a TransUnion company; recipients must enroll within 90 days of the letter date.
The case also raises practical questions for customers of services that rely on outside vendors. A company may share data with providers to support its operations, while the security incident occurs within a vendor’s environment. The available notices establish that Uber data was accessed through a provider account, but do not describe the precise system or the route by which each person’s information was stored there.
Products Worth Considering
LG 27US500-W 27-Inch 4K UHD IPS Monitor
Dell UltraSharp U2724DE 27-Inch WQHD IPS Black Monitor
Dell UltraSharp U3225QE 31.5-Inch 4K UHD 120Hz IPS Black Thunderbolt Hub Monitor
As an affiliate, we earn on qualifying purchases.
How Fireworks Entered the Case
Fireworks AI provides tools for running and customizing open AI models for businesses. Its own security bulletins say it identified unauthorized use of internal Fireworks credentials on October 6, Pacific time. The company said a third party accessed environment variables used in evaluation jobs in a limited number of customer accounts. Fireworks said it began notifying affected customers on October 7 and notified customers it had identified on the evening of October 9.
Those dates broadly align with Uber’s account: the California filing lists October 7 as the breach date, while Uber says it received a vendor alert on October 9 and determined by October 13 that Uber data had been accessed. The dates do not, by themselves, show exactly when the Uber information was accessed or which Fireworks system contained it.
In an update last revised November 9, Fireworks said the incident affected account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. The company said evidence linked the activity to a financially motivated group seeking to sell tokens obtained through unauthorized access to large language models, a practice known as “LLMJacking.” TechCrunch reported that no known group had claimed the theft. These statements concern Fireworks’ wider incident; they do not identify what specific Uber data was present in the affected systems.
““An unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.””
— Uber, in a notice to affected people
Scope and Data Details Remain Open
The total number of people affected is not known publicly. Uber has not announced a national count, and state reports are incomplete. The figures reported for Rhode Island, Massachusetts and South Carolina cover only those states; the Illinois count was pending in the reporting cited by TechCrunch, and no California count was provided.
It is also not clear from the public sample notice what information was accessed for each person, how many Uber records were involved, or which Fireworks system held them. The recipient’s own notice is the source identified for the specific data field. Uber says it has not identified misuse to date. No public information in the source material establishes whether the incident led to identity fraud or whether additional data was accessed.
Notices and State Counts Ahead
People who receive a letter should check its individualized description of the affected information and the enrollment deadline for the offered monitoring. Uber’s sample notice says the credit-monitoring and fraud-assistance service is provided through Cyberscout and must be activated within 90 days of the letter date.
Further clarity may come from additional state filings, updated notices or statements from Uber and Fireworks. The key outstanding details are the national number of affected people, the full range of information involved and whether investigators find evidence of misuse. Until those details are published, the state counts should be treated as partial, and Uber’s no-misuse statement as its assessment to date.
Key Questions
Was Uber itself hacked?
Uber’s notice describes an unauthorized party using compromised credentials at a service provider to access Uber’s account and data connected to that provider. It does not describe an intrusion into Uber’s own systems.
Which AI vendor was involved?
Uber identified Fireworks.ai as the third-party vendor to TechCrunch. The public sample notice filed with California regulators does not name the provider.
What information was exposed?
TechCrunch reported that breach notices it reviewed included driver’s license information. Uber’s public sample letter leaves the specific data field blank, so recipients should check their own letter for details about their information.
How many people were affected?
A complete national total has not been disclosed. The available reports list about 1,873 people in Rhode Island, 2,567 in Massachusetts and 3,430 in South Carolina; other state counts are incomplete or unavailable.
What support is Uber offering?
Uber says affected people can access credit monitoring and fraud assistance through Cyberscout, a TransUnion company. The sample notice says enrollment must take place within 90 days of the letter date.
Source: ThorstenMeyerAI.com
