🔍 Read the full analysis: After The Uber AI Vendor Breach, Drivers Can Take These Steps on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Uber has notified people whose information was accessed through a third-party vendor, identified to TechCrunch as Fireworks AI. Notices seen by TechCrunch say the information includes driver’s license data; recipients should check their own letter for the specific data involved and can enroll in free credit monitoring and fraud assistance within 90 days of the letter date.
Uber has begun sending breach notices to people whose personal information was accessed through a third-party service provider, which Uber identified to TechCrunch as Fireworks AI. Notices reviewed by TechCrunch say the information includes driver’s license data; affected recipients are being offered free credit monitoring and fraud assistance, but each person’s letter is the best available source for what specific information was involved.
Uber’s notice filed with the California attorney general says a service provider told the company on October 9, 2026, that an unauthorized person had compromised the provider’s internal credentials and used them to access Uber’s account there. Uber says its investigation found on October 13 that Uber data connected to the provider had been accessed. The filing lists October 7 as the breach date and November 10 as the reporting date.
The regulator filing does not name the vendor or specify the data for every recipient. An Uber spokesperson told TechCrunch the incident involved Fireworks.ai, which had access to some Uber data. A Fireworks spokesperson separately confirmed to TechCrunch that unauthorized access to some company systems affected customer data. The sample letter leaves the affected-data field blank for recipient-specific information; TechCrunch reports that breach notices it reviewed included driver’s license information.
Uber says it has not identified misuse of recipients’ data to date. Its notice offers free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must take place within 90 days of the date on the recipient’s letter. The notice says Uber severed data connections with the provider after learning of the incident and started an investigation.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
Protecting Drivers’ Identity Information
Driver’s license information can be used as identifying data, so recipients should take the notice seriously even though Uber says it has found no misuse to date. The breach also shows how information shared with a service provider can be exposed outside a company’s own systems. Uber’s account describes access through a vendor’s compromised credentials, not an intrusion into Uber’s internal systems.
For drivers, the immediate practical issue is that the public sample notice does not identify which data each person’s record contained. The individualized letter may specify what information was accessed and how to enroll in support. People who receive one should keep it, follow the enrollment instructions, and use the contact details in the notice to ask questions if anything is unclear. These steps are general precautions, not a claim that anyone’s identity has been misused.
The reported figures also do not establish the incident’s full reach. Uber’s notice cites about 1,873 Rhode Island residents; TechCrunch reported notices involving 2,567 people in Massachusetts and 3,430 in South Carolina. Those state figures total 7,870, but they are not a national count, and reporting on other states indicates that some totals remain pending or undisclosed.
Products Worth Considering
LG UltraGear 45GX950A-B 45-Inch 5K2K Curved OLED Gaming Monitor
Ledger Nano X Family Pack – 3 Crypto Hardware Wallets with Bluetooth
Apple MacBook Pro 14.2-inch with Tandem OLED Display, Space Black
As an affiliate, we earn on qualifying purchases.
How the Vendor Incident Reached Uber
Fireworks AI provides a platform for businesses to run and customize open AI models. In its security bulletins, the company says it identified unauthorized use of internal credentials on October 6, Pacific time. Fireworks reported that an unauthorized party accessed environment variables used in evaluation jobs in a limited number of customer accounts. The company says it began notifying affected customers on October 7 and notified the customers it had identified on the evening of October 9.
Those dates broadly align with Uber’s notice, which says the vendor contacted Uber on October 9 and identifies October 7 as the breach date. Fireworks’ later bulletin, revised November 9, describes effects to account and billing information and, for a limited set of accounts, secrets, datasets, and incomplete models. Neither company has publicly identified which Fireworks system held the Uber data or described the precise path from the compromised credentials to the driver information.
Fireworks has said evidence links the activity to a financially motivated group seeking to sell access to large language models, a practice called LLMJacking. That is the company’s assessment, not a confirmed attribution of the theft to a named group. TechCrunch reported that no known group had claimed responsibility.
““Uber has not identified any misuse of your data to date.””
— Uber, in its notice to affected people
The Scope Is Still Incomplete
The total number of affected people is not known. Uber has not publicly stated how many customers or drivers it is notifying. State filings and notices reviewed by TechCrunch provide partial counts: Uber’s filing cites about 1,873 Rhode Island residents, while TechCrunch reported 2,567 in Massachusetts and 3,430 in South Carolina. An Illinois filing said the number was pending, and the number of California recipients was not reported in the material provided.
The data field in the public sample letter is blank, so it does not show what information was involved for each recipient. The reports of driver’s license information come from notices reviewed by TechCrunch, not a complete public inventory from Uber. It is also not clear which Fireworks system contained the affected Uber data, whether additional information was accessed, or whether any misuse has occurred beyond what Uber says it has identified so far.
Check Notices and State Filings
People who receive an Uber security notice should read the individualized data description, note the letter date, and follow the instructions for enrolling in Cyberscout’s monitoring and fraud assistance within the stated 90-day period. Recipients can use the notice’s contact information to confirm eligibility or ask what data was involved. They should also treat unexpected messages claiming to offer help with the breach cautiously and rely on contact details they can verify independently.
Uber’s public notice says it investigated the access and severed the vendor connection; the available material does not give a date for a final investigation report. Further information may come through updated state filings, additional notices, or statements from Uber and Fireworks. Until then, the affected population and the full range of exposed data remain unresolved.
Key Questions
What happened in the Uber data incident?
Uber says a third-party provider notified it on October 9, 2026, that compromised internal credentials had been used to access Uber data connected to the provider. Uber identified the vendor as Fireworks AI to TechCrunch.
Was driver’s license information exposed?
TechCrunch reported that notices it reviewed included driver’s license information. The public sample letter does not specify the information for every recipient. Check your own notice for the data Uber says was involved in your case.
What should someone who receives a letter do?
Read the letter for the individualized data description and enrollment instructions. Uber is offering free credit monitoring and fraud assistance through Cyberscout, with enrollment required within 90 days of the letter date.
How many people were affected?
There is no national total in the information available. Uber’s filing cites about 1,873 Rhode Island residents; TechCrunch reported 2,567 people in Massachusetts and 3,430 in South Carolina. Other state counts were pending or not disclosed.
Has Uber found evidence that the information was misused?
Uber said it had not identified misuse to date. That statement reflects the company’s findings when it issued the notice and does not establish what may be found later.
Source: ThorstenMeyerAI.com
