🔍 Read the full analysis: Uber Drivers Face A License Data Breach: Steps For Staying Alert on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Uber has begun notifying people whose personal information was accessed through a third-party vendor, Fireworks.ai. TechCrunch reports that breach notices include driver’s license information, but Uber has not provided a national count; affected people should check their individual letters for the data involved and enrollment details for free assistance.
Uber has begun notifying people in the United States that their personal information was accessed in an incident involving Fireworks.ai, a third-party vendor with access to some Uber data. Driver’s license information is among the data described in breach notices seen by TechCrunch, though the public sample letter does not specify which information was involved for each recipient, and the total number of affected people is not known.
In a notice filed with the California attorney general and dated November 10, 2026, Uber said a service provider told the company on October 9 that an unauthorized third party had compromised the provider’s internal credentials and used them to access Uber’s account with the provider. Uber said its investigation found on October 13 that Uber data connected to the service provider had been accessed. The filing lists October 7 as the breach date.
The public notice does not name the provider or identify the data involved. An Uber spokesperson told TechCrunch the incident involved Fireworks.ai, which had access to some Uber data. A Fireworks spokesperson told the outlet the company had identified unauthorized access to some of its systems that affected customer data. TechCrunch reports that breach notices it reviewed include driver’s license information. Recipients must check their own letters: the sample letter leaves the field describing affected information blank.
Uber’s filing says about 1,873 Rhode Island residents were affected. TechCrunch reports notices for 2,567 people in Massachusetts and 3,430 in South Carolina. Those reported state figures total 7,870, but they do not establish a national count. TechCrunch also reported that an Illinois filing listed driver’s license information while the number of affected people was pending, and that California drivers were notified without a public count.
Uber says recipients can access free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must be completed within 90 days of the date on the letter. Uber’s notice says it has “not identified any misuse of your data to date”; that statement describes the company’s findings so far, not a guarantee that information cannot be misused later.
Uber driver data breach · Oct 6 – Nov 13, 2026
How driver data was reached through a vendor
What Uber, its vendor and the first reports say happened, step by step.
Where the data was (schematic)
What happened
- Oct 6Fireworks detects misuse of its internal credentials and starts containmentPacific time, per Fireworks
- Oct 7Date of breach in Uber’s California filing
- Oct 9The provider alerts Uber; Uber cuts its data connections and investigates
- Oct 13Uber’s investigation: Uber data was accessed
- Nov 10Letters dated; notice filed with the California attorney general
- Nov 13TechCrunch: driver’s license data stolen; Uber names Fireworks.ai
- 90 daysAffected people can enroll in free credit monitoring; credit reports, fraud alert or freeze
Sources: Uber notice of November 10, 2026 and breach entry, California Attorney General; Fireworks AI security bulletins (last updated Oct 10 and Nov 9, 2026); TechCrunch, Nov 13, 2026. The chain is a schematic; Uber has not said what the data was used for.
Graphic: Powered by Thorsten Meyer AI
Why Driver’s License Exposure Matters
A driver’s license contains personal identifying information, so its exposure can create risks beyond the immediate incident, including attempts to impersonate someone or misuse their details. The notices make the breach relevant to drivers who may not have known that a vendor outside Uber’s own systems had access to Uber data.
For people who receive a letter, the practical issue is whether their specific license information was included and what protective steps apply. Uber’s offer of monitoring and fraud assistance gives recipients a way to track certain signs of misuse, but the service does not establish that misuse has occurred or prevent every form of identity fraud. The 90-day enrollment deadline makes the date on each individual letter important.
The incident also highlights a distinction in Uber’s account of what happened: the company describes access through a service provider’s compromised credentials, not an intrusion into Uber’s own systems. That distinction identifies the reported route into the data, but it does not answer how much information was exposed or how many people were affected nationwide.
Products Worth Considering
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
Samsung Odyssey OLED G5 27-Inch QHD Gaming Monitor
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
As an affiliate, we earn on qualifying purchases.
How the Vendor Incident Unfolded
Fireworks’ security bulletins say it identified unauthorized use of internal credentials on October 6, Pacific time, and found that an unauthorized party accessed environment variables used in evaluation jobs in a limited number of customer accounts. Fireworks said it began notifying affected customers on October 7. On the evening of October 9, it notified customers it had identified and published its first bulletin.
Uber’s dates partly align with that account: its filing gives October 7 as the breach date and says a service provider notified it on October 9. Uber said it severed data connections with the provider after receiving the alert and opened an investigation. Its investigation found access to Uber data connected to the provider on October 13. These descriptions do not identify which Fireworks system contained the Uber data.
In an update last revised November 9, Fireworks said the incident affected account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. Fireworks said evidence linked the activity to a financially motivated group seeking to sell tokens obtained through unauthorized access to large language models, a practice known as “LLMJacking.” That is the company’s account of the activity; the source material says no known group had claimed the theft.
““Uber has not identified any misuse of your data to date.””
— Uber, in its notice to affected people
The National Count Is Unknown
Uber has not publicly stated how many people nationwide received notices or how many drivers were affected. State figures provide only a partial picture: Massachusetts and South Carolina counts were reported by TechCrunch, while Illinois’ reported count was pending and California’s was not disclosed. The combined figure of 7,870 from Rhode Island, Massachusetts and South Carolina is a sum of those reported state counts, not a national total.
It is also not clear from the public sample notice which data fields were involved for any particular recipient. TechCrunch reported driver’s license information in notices it reviewed, but the individual letter is needed to determine what Uber says was accessed in a recipient’s case. The available information does not identify the specific Fireworks system involved, explain how the Uber data was stored there, or provide a complete account of the information accessed.
Uber says it has not identified misuse to date. The source material does not establish whether anyone’s information has since been used fraudulently, whether additional affected people will be identified, or whether the reported state counts will change.
Check Notices and Enrollment Deadlines
People who receive an Uber security notice should read the section naming the information involved and follow the enrollment instructions for Cyberscout. The stated deadline is 90 days from the date on the letter; recipients should use that date rather than assume a single deadline applies to everyone. They should keep the notice and monitor relevant financial and identity records for activity they do not recognize.
The next developments may include further state filings, revised affected-person counts or additional information from Uber and Fireworks about the data involved. Neither company’s statements in the source material provide a national total or a complete technical account of how Uber’s data was held at the vendor. Until those details are released, the individual notice remains the clearest source for a recipient’s specific exposure.
Key Questions
What happened to Uber drivers’ information?
Uber says a third-party service provider notified it that compromised internal credentials had been used to access Uber’s account with the provider. Uber’s investigation found that Uber data connected to the provider had been accessed. Uber identified the vendor to TechCrunch as Fireworks.ai.
Was driver’s license information exposed?
TechCrunch reported that breach notices it reviewed include driver’s license information. Uber’s public sample letter leaves the affected-data field blank, so recipients should check their own notice to see which information Uber says was involved in their case.
How many people were affected?
A national total has not been disclosed. The source material gives reported counts of about 1,873 in Rhode Island, 2,567 in Massachusetts and 3,430 in South Carolina. Those three figures add to 7,870, but they are not a complete nationwide count.
What should someone who receives a letter do?
Read the letter to identify the information involved and follow its instructions for free credit monitoring and fraud assistance through Cyberscout. Enrollment must occur within 90 days of the letter date. Uber says it has not identified misuse to date, but recipients can continue watching for activity they do not recognize.
Source: ThorstenMeyerAI.com
