🔍 Read the full analysis: Uber Drivers’ License Information Stolen: How To Respond on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Uber says an unauthorized party used compromised credentials at a third-party provider to access Uber data connected to the provider. TechCrunch reports that notices identify driver’s license information among the exposed data, but the public sample letter does not specify which information applied to each recipient. Uber is offering affected people 90 days to enroll in free credit monitoring and fraud assistance.
Uber has begun notifying people that their personal information was accessed through a security incident at third-party vendor Fireworks AI; breach notices reviewed by TechCrunch include driver’s license information among the data affected. Uber says it has not identified misuse of recipients’ information to date and is offering affected people free credit monitoring and fraud assistance.
In a notice filed with the California attorney general and dated November 10, 2026, Uber said a service provider told the company on October 9 that an unauthorized party had compromised the provider’s internal credentials and used them to access Uber’s account there. Uber said its investigation found on October 13 that Uber data connected to the provider had been accessed. The filing lists October 7 as the breach date.
The public sample letter does not name the provider or specify the data involved. Uber identified Fireworks.ai as the vendor in a statement to TechCrunch, saying the company had access to some Uber data. TechCrunch reported that individual breach notices list driver’s license information, but the sample letter’s data field is left blank; recipients need to consult their own letters to see what information was involved in their case.
Uber’s filing says about 1,873 Rhode Island residents were affected. TechCrunch reported figures of 2,567 in Massachusetts and 3,430 in South Carolina. Those figures add to 7,870 across the three states, but they do not establish a national total. TechCrunch also reported notifications in California and an Illinois filing that listed driver’s license information while saying the number affected was pending.
Uber is offering eligible recipients services through Cyberscout, a TransUnion company. The company’s letter says enrollment must take place within 90 days of the letter date. The letter also states that Uber has not identified any misuse of the recipient’s data to date.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
Why Drivers Should Check Their Notices
A driver’s license number is identifying information that people cannot change as readily as a password. Its exposure can increase the risk of identity-related fraud, though the available information does not establish that anyone has used the data improperly. Uber says it has found no misuse to date.
The incident also shows how a breach at a vendor can affect people whose information was shared with that provider. Uber’s filing describes access to its account and data at the service provider; it does not describe an intrusion into Uber’s own systems. For drivers and other recipients, the immediate practical issue is determining which data their individual notice says was accessed and meeting the enrollment deadline for the offered support.
The state-by-state figures provide only a partial picture. With no national count disclosed, it is not yet possible to establish how many drivers or other people received notices across the United States.
Products Worth Considering
Anker SOLIX C300 DC Portable Power Station with 60W Solar Panel, 288Wh, 300W
Bose TV Speaker (2nd Gen) Compact Soundbar with Bluetooth and HDMI-ARC, Black
Bose QuietComfort Wireless Noise-Cancelling Headphones, Cypress Green
As an affiliate, we earn on qualifying purchases.
How the Vendor Incident Reached Uber
Fireworks AI provides a platform businesses use to run and customize open AI models. In its own security updates, Fireworks said it identified unauthorized use of internal credentials on October 6, Pacific time. The company said an unauthorized party accessed environment variables used in evaluation jobs in a limited number of customer accounts. Fireworks said it began notifying affected customers on October 7 and notified the customers it had identified by the evening of October 9.
Those dates broadly align with Uber’s filing, which identifies October 7 as the breach date and says the provider notified Uber on October 9. Uber said it immediately severed data connections with the provider and opened an investigation. The filing says the investigation determined on October 13 that the compromised credentials had been used to access Uber data connected to the service provider.
Fireworks’ security update, last revised November 9, says the incident affected account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. Fireworks said evidence linked the activity to a financially motivated group seeking to sell unauthorized access to large language models. TechCrunch reported that no group had publicly claimed the theft. Neither company has specified which Fireworks system held the Uber data.
“An unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.”
— Uber’s security notice
How Many Drivers Were Notified
The total number of affected people nationwide remains unknown. Uber has not disclosed a national count or said how many drivers it is notifying, according to TechCrunch. The figures reported for Rhode Island, Massachusetts and South Carolina cover only those states, while the Illinois count was still pending in the filing described by TechCrunch.
The exact information exposed for each person is also not clear from the public sample letter, which leaves the affected-data field blank. TechCrunch says individual notices include driver’s license information, but recipients should rely on their own letters for the details specific to them. The companies have not said which Fireworks system held the Uber data, and Uber has reported no identified misuse so far.
Notice Deadlines and Further Counts
People who receive a notice should read it to identify the data listed for their case and follow its instructions for enrolling in the Cyberscout credit-monitoring and fraud-assistance services. The stated enrollment window is 90 days from the date on the letter, so recipients should check that date rather than assume a single deadline applies to everyone.
Further state filings or company updates may clarify the number of people affected and the data involved. Uber’s notice says the company severed data connections after learning of the incident and investigated the access. Neither Uber nor Fireworks has disclosed a national recipient total or a more specific account of where the Uber information was held.
Key Questions
What happened to Uber drivers’ information?
Uber says compromised credentials at a third-party provider were used to access Uber data connected to the provider. Uber identified the vendor as Fireworks.ai; TechCrunch reports that notices include driver’s license information.
Does the public notice say exactly what information was exposed?
No. The public sample letter leaves the affected-data field blank. TechCrunch reports driver’s license information in individual notices, so recipients should check their own letter for the specific information listed.
How many people were affected?
A nationwide total has not been disclosed. Uber reported about 1,873 Rhode Island residents; TechCrunch reported 2,567 in Massachusetts and 3,430 in South Carolina. Other state counts were not fully available in the source material.
What should someone who receives a letter do?
Read the notice to confirm what information it says was accessed, then follow its enrollment instructions for the offered credit monitoring and fraud assistance. Uber says enrollment must occur within 90 days of the letter date.
Has Uber reported that the stolen information was misused?
Uber’s notice says it has not identified any misuse to date. That reports the company’s current findings; the notice does not establish what may happen later.
Source: ThorstenMeyerAI.com
