Uber is notifying thousands of its drivers that their personal and driver's license information was stolen in October. Hackers did not get in through Uber's own systems. They broke into one of its technology providers and used that company's stolen internal credentials. Uber has filed breach notices with several US state attorneys general, including California, Massachusetts, South Carolina, Rhode Island and Illinois. State filings show 3,430 affected residents in South Carolina, 2,567 in Massachusetts and about 1,873 in Rhode Island. That is roughly 7,870 people across those three states. Uber has not disclosed a national total. An Uber spokesperson told TechCrunch that the vendor is Fireworks AI, a platform that gives developers access to open AI models. Uber's regulatory notices do not name the provider.
What Happened
Uber's notification letter, dated November 10, 2026, sets out this sequence:
- October 9: A service provider told Uber that an unauthorized third party had compromised the provider's internal login credentials and used them to access Uber's account with that provider.
- After the alert: Uber says it cut its data connections with the provider and opened an investigation. Some coverage has described this as Uber "cutting ties" with the vendor. The notice itself only describes cutting data connections.
- October 13: Uber's investigation found that the unauthorized party had accessed Uber data connected to the provider.
- November 10: Uber began sending notices to affected individuals and filed them with state regulators.
ClaimDepot and Crypto Briefing both report that unauthorized access began as early as October 7. Uber's letter, as summarised by WLTX and the law firm Strauss Borrelli, does not give that date, and TechCrunch does not report it. Treat October 7 as reported rather than confirmed. Dapeer Law counts about 32 days between Uber learning of the breach and the first notices going out.
The filings do not name the vendor. TechCrunch did, and an Uber spokesperson confirmed it: "The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data." Uber sent further questions to Fireworks. A Fireworks spokesperson confirmed to TechCrunch that there had been unauthorized access to some of its systems that affected customer data, but did not answer detailed questions.
The Uber notices are one part of a larger breach. Last month Fireworks disclosed that hackers stole customer information, including billing data and some private AI datasets. TechCrunch reports that Notion has also confirmed its data was taken in the Fireworks breach.
What Was Taken
Uber says the affected data includes driver's license information, and Massachusetts regulatory data lists driver's license numbers specifically. Notices describe both personal information and license data. The publicly posted copies of Uber's letter leave out the specific data types for each recipient, so each person has to read their own letter to see what was exposed. Neither Uber nor any regulator filing says whether other fields, such as dates of birth or addresses, were included.
Confirmed counts by state:
| State | Affected residents | Source |
|---|---|---|
| South Carolina | 3,430 | SC Department of Consumer Affairs |
| Massachusetts | 2,567 | Massachusetts Attorney General |
| Rhode Island | ~1,873 | Rhode Island notice addendum |
| Illinois | Not disclosed | Illinois filing confirms residents affected |
| California | Not disclosed | Notice filed with the Attorney General |
Every source agrees on the state-level figures. None gives an overall total. Uber did not tell TechCrunch how many drivers or customers were affected. South Carolina only requires a copy of the notice to be sent to the state when more than 1,000 residents are affected, so smaller groups in other states may never appear in public records.
Uber says it has found no misuse of the data so far. It is offering free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. People must enroll within 90 days of the letter date, using the activation code in their letter. Uber has also set up a support line at 1-866-317-7961, which is open weekdays from 8 a.m. to 8 p.m. Eastern.
Why It Matters
AI vendors now hold sensitive production data. Fireworks sells access to AI models. It is not a payroll or HR system. Even so, it had enough Uber driver data for a breach there to expose government ID numbers. As companies send data to AI inference and fine-tuning platforms, those platforms end up holding regulated personal data. They often get less vendor scrutiny than traditional data processors. The German outlet IT BOLTWISE makes the same point, calling the incident a supply-chain weakness between open-model AI platforms and the customer data behind them.
One vendor breach, several victims. Fireworks customer data, billing records, private datasets, Uber driver records and Notion data were all taken in the same intrusion. A single compromised provider can produce a series of breach notices from its customers, often weeks after the vendor's own disclosure.
Driver's license numbers are hard to replace. Unlike a password, a license number cannot be rotated quickly. It is useful for identity fraud, synthetic identities and social engineering. Drivers on gig platforms are often independent contractors, so they may have less employer support when fraud follows.
Uber has a history here. In 2022, an attacker Uber linked to Lapsus$ got into Uber's internal systems. They used a contractor password bought after an infostealer infection, then bombarded the contractor with MFA push requests until one was accepted, as osec.one describes. Nothing suggests the two incidents are connected. But they share a pattern: in both, the way in was a trusted third party's credentials rather than a software flaw.
The Attack Technique
Here is what is confirmed. The attacker got hold of internal credentials belonging to the service provider. They then used those credentials to log into Uber's account on the provider's platform and reach Uber data stored or connected there. That is a stolen-credential intrusion at the vendor, followed by access to customer accounts using the vendor's own legitimate access.
Uber, Fireworks and the regulator filings have not said how the credentials were stolen. Phishing, infostealer malware and leaked secrets are all possible. Nobody has said whether MFA was in place, and no group has claimed the attack. Fireworks has not published a technical post-mortem. Until it does, defenders should treat this as a vendor credential compromise with an unknown initial access method.
What Organizations Should Do
- List every AI vendor that holds your data. Inference, fine-tuning, evaluation and vector-storage providers belong in your data processor register. Record what data each one holds, why, and for how long. Remove anything the workload does not need, such as government ID numbers.
- Minimise and tokenise data before it reaches third-party AI platforms. Driver's license numbers, Social Security numbers and other regulated identifiers should be removed, masked or tokenised before data goes into a vendor's environment.
- Be ready to cut a vendor off quickly. Uber's first step was to cut data connections. Keep a documented, tested process for revoking API keys, OAuth grants, service accounts and sync jobs for any single vendor within hours.
- Require vendors to secure their admin access. Contracts and security reviews should require phishing-resistant MFA, such as FIDO2 or passkeys, on vendor staff and administrator accounts. Push-only MFA can be beaten by push bombing, as Uber's 2022 breach showed. Also require short-lived credentials and notification of any internal credential compromise within a set number of hours.
- Monitor activity on your own vendor accounts. Collect audit logs from vendor platforms where you can. Alert on unusual exports, access from new locations or IP addresses, and logins using vendor-side support or admin roles.
- After a vendor breach, check your own data. When a vendor discloses a breach, assume your data may be included until the vendor proves otherwise. Start your own investigation and work out your notification obligations immediately. Don't wait to be told.
Sources: Uber confirms hackers stole thousands of drivers' license informati... | Uber Data Breach Investigation | Uber data breach affected 3,430 South Carolina residents, state rec... | Uber Data Breach Exposes Driver's License Info of Thousands | Uber Technologies Data Breach Notice (2026): What to Do | Uber confirms vendor breach exposed thousands of drivers' licenses | Uber meldet Diebstahl von Führerscheindaten über Fireworks-AI-Zugriff | Uber 2022: how push-notification fatigue turned one bought password...