TL;DR
Uber says a third-party vendor’s compromised internal credentials were used to access Uber data held by the provider. TechCrunch reports that affected notices include driver’s license information; Uber says affected people can enroll in free credit monitoring and fraud assistance within 90 days of their letter date. The national number affected and how the data may have been used remain unknown.
Uber says data connected to its account with a third-party service provider was accessed after the provider’s internal credentials were compromised, and TechCrunch reports that notices to affected people include driver’s license information. Uber says it cut the data connection and is offering free credit monitoring and fraud assistance to recipients, who must enroll within 90 days of the date on their letter.
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
In a notice filed with the California attorney general and dated November 10, 2026, Uber says a service provider told the company on October 9 that an unauthorized person had compromised the provider’s internal credentials and used them to access Uber’s account with that provider. Uber says it severed the data connection after being notified and began an investigation. By October 13, the investigation had found that Uber data connected to the provider had been accessed.
The public sample letter does not name the provider or specify which information was involved; its data field is left blank for individual recipients. Uber identified the provider as Fireworks.ai in a statement to TechCrunch. The outlet reports that breach notices it reviewed include driver’s license information. Recipients should use their own letter to determine what personal information Uber says was involved in their case.
Uber’s filing says about 1,873 Rhode Island residents were affected. TechCrunch reported 2,567 people in Massachusetts and 3,430 in South Carolina. Those figures add up to 7,870 across the three states, but they do not establish a national total. Uber says it has not identified misuse of recipients’ data to date.
Protecting Identity After Exposure
A driver’s license number is sensitive personal information that can be used in attempts at identity fraud. The available reporting does not establish that anyone has used the accessed data for fraud, and Uber says it has not identified misuse so far. Still, recipients can take practical steps to learn what was exposed, monitor relevant accounts and respond promptly to suspicious activity.
The incident also shows how information held by a service provider can be reached through that provider’s credentials. Uber’s notice describes access to its account with the vendor and data connected to that account; it does not describe an intrusion into Uber’s own systems. For drivers, the immediate question is whether their personal information was included and what safeguards are available to them.
Products Worth Considering
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Samsung Odyssey G7 G75F 40-Inch WUHD Curved Gaming Monitor
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
As an affiliate, we earn on qualifying purchases.
How the Vendor Incident Reached Uber Data
Fireworks AI provides a platform businesses use to run and customize open artificial intelligence models. In its security bulletins, Fireworks said it identified a security incident involving unauthorized use of internal credentials on October 6, Pacific time. The company said an unauthorized third party accessed environment variables used in evaluation jobs in a limited number of customer accounts, and that it began notifying affected customers on October 7.
Uber’s notice gives October 7 as the breach date in its California filing. It says the provider notified Uber on October 9 and that Uber’s investigation determined on October 13 that data connected to the provider had been accessed. The sequence describes a vendor-related incident and the later discovery of access to Uber data. The public materials provided do not explain whether the data accessed through Uber’s account overlapped with the environment variables Fireworks described.
The California filing says letters were dated November 10. TechCrunch reported on the driver’s license information and Uber’s identification of Fireworks on November 13. Reuters, which also reviewed the filing, reported that the notice did not name the provider or list the affected data.
““An unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.””
— Uber, in its security incident notice
What Drivers’ Letters Will Specify
The full scope remains unsettled. The public sample letter leaves the affected-data field blank, so recipients need to check their own notice for the information Uber says applied to them. TechCrunch reports that driver’s license information appears in breach notices it reviewed, but the source material does not establish that every recipient’s license data was affected.
Uber’s filing gives a count for Rhode Island, while the Massachusetts and South Carolina figures come from TechCrunch. No national total is available in the cited material. It is also not clear whether all affected people have been notified, whether additional states will report counts, or whether the accessed data has been misused. The source material says Uber has not identified misuse to date.
Use the Notice and Enrollment Deadline
Anyone who receives a letter should read it to identify the information Uber says was accessed and follow the enrollment instructions. Uber offers free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must occur within 90 days of the letter date, so recipients should check that date and the notice for the applicable deadline and terms.
Recipients can also review their credit reports and consider placing a fraud alert or credit freeze if they are concerned about identity theft. They should watch for unfamiliar account activity and report suspected misuse to the relevant financial institution or authorities. Further details may emerge if Uber or Fireworks provides updated information or more state notices disclose affected counts.
Key Questions
What happened to Uber drivers’ data?
Uber says a third-party provider’s compromised internal credentials were used to access Uber data connected to the provider. TechCrunch reports that notices reviewed by the outlet include driver’s license information.
How can I tell whether my license information was affected?
Check your individual notice from Uber. The public sample letter leaves the affected-data field blank, and the letter sent to you is the source material that identifies what Uber says applied to your case.
How long do I have to enroll in the monitoring service?
Uber says recipients must enroll in free credit monitoring and fraud assistance within 90 days of the date on their letter. Check the letter for the deadline and enrollment instructions.
How many people were affected?
Uber reported about 1,873 Rhode Island residents. TechCrunch reported 2,567 in Massachusetts and 3,430 in South Carolina. Together those figures total 7,870 across three states; a national total is not available in the cited material.
Has Uber reported that the stolen data was misused?
Uber said it had not identified any misuse of recipients’ data to date. The available information does not establish whether misuse occurred later or whether any further findings will be reported.
Source: Thorsten Meyer AI
