TL;DR
Uber is notifying people whose information was accessed through a third-party vendor, identified by Uber to TechCrunch as Fireworks.ai. TechCrunch reported that breach notices include driver’s license information, but Uber’s public sample letter leaves the affected data field blank. The company says it has not identified misuse and is offering eligible recipients 90 days to enroll in free credit monitoring and fraud assistance.
Uber is notifying people whose personal information was accessed through a third-party service provider, which the company identified to TechCrunch as Fireworks.ai. TechCrunch reports that some breach notices include driver’s license information; the public sample letter does not specify which data was involved for each recipient. Uber says it has not identified misuse and is offering affected people free credit monitoring and fraud assistance.
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
In a notice filed with the California attorney general and dated November 10, 2026, Uber said a service provider alerted it on October 9 that an unauthorized party had compromised the provider’s internal credentials and used them to access Uber’s account with that provider. Uber said it cut its data connections to the provider and opened an investigation. By October 13, the investigation had found that Uber data connected to the service provider had been accessed.
The regulatory notice does not name the provider. An Uber spokesperson identified it as Fireworks.ai in comments to TechCrunch, saying the vendor had access to some Uber data. Fireworks also told TechCrunch it had identified unauthorized access to some of its systems that affected customer data. The public sample notice leaves the affected-data field blank, while TechCrunch reported that notices it reviewed list driver’s license information. Recipients should check their own letters to learn which information Uber says was involved in their case.
Uber’s notice lists about 1,873 Rhode Island residents as affected. TechCrunch reported figures of 2,567 in Massachusetts and 3,430 in South Carolina. Those reported state counts total 7,870, but there is no national total in the material available. Uber says recipients can enroll in free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must be completed within 90 days of the date on the letter.
How the Vendor Breach Reached Drivers
The incident shows how personal information entrusted to a company can also be exposed through an outside provider with access to that company’s data. Uber’s notice describes access through its account with the provider; it does not describe an intrusion into Uber’s own systems. For drivers and other affected people, the practical concern is whether information in their individual notice could be used in identity fraud.
Driver’s license information can be sensitive personal data. The reported state figures establish that thousands of people were notified in three states, but they do not show the full scope of the incident. Nor do the available accounts establish that anyone has used the accessed information. Uber says it has not identified misuse to date.
The offered monitoring and fraud assistance give recipients a way to watch for signs of identity misuse, but the notice’s 90-day enrollment window makes checking the letter promptly useful. The letter also matters because the public sample does not identify the affected data for each recipient.
Products Worth Considering
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
Apple MacBook Pro 16.2-inch with M5 Pro, 18-core CPU, 20-core GPU, 24GB Memory, 1TB SSD, Wi-Fi 7, Space Black
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
As an affiliate, we earn on qualifying purchases.
From Fireworks Credentials to Uber Data
Fireworks AI provides a platform for running and customizing open AI models for businesses. In its security bulletins, the company said it identified unauthorized use of internal credentials on October 6, Pacific time. Fireworks said an unauthorized party accessed environment variables used in evaluation jobs in a limited number of customer accounts, and that it began notifying affected customers on October 7.
Uber’s filing gives October 7 as the breach date. It says the provider notified Uber on October 9, after which Uber severed data connections and investigated. The investigation found on October 13 that the compromised credentials had been used to access Uber data connected to the provider. Uber’s letters are dated November 10. TechCrunch reported the driver’s license information and Uber’s identification of Fireworks on November 13.
The dates come from different records and accounts: Uber’s filing and notice, Fireworks security bulletins, and reporting by TechCrunch. The available information describes a credential compromise at the provider and access to data connected with Uber’s account there. It does not establish what the intruder did with the data.
““An unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.””
— Uber, in its notice to affected people
The Letters Define Each Person’s Exposure
The affected data may vary by recipient. Uber’s public sample notice leaves that field blank, so it does not tell every reader whether a driver’s license number or other personal information was involved. The individual letter is the available source for what Uber says was accessed in a specific case.
The available material gives counts for Rhode Island, Massachusetts and South Carolina, but not a national total. It also does not establish whether the accessed information was copied, how it may have been used, or whether any misuse has occurred. Uber says it has not identified misuse to date. The identities of the unauthorized party and the full set of affected customers are not stated in the supplied accounts.
Check the Notice and Enroll in Monitoring
People who receive an Uber security incident letter should read it for the specific data listed and follow its enrollment instructions if they want the offered Cyberscout credit monitoring and fraud assistance. Uber says enrollment is available for 90 days from the letter date. The letter is also the source for the recipient’s own notice details, which are absent from the public sample.
Uber says it has cut data connections with the provider and investigated the access. Further clarity would depend on additional notices or statements from Uber, Fireworks or regulators, including any updated affected-person count or information about misuse. The supplied material does not give a date for a further update.
Key Questions
What happened to Uber driver data?
Uber says compromised internal credentials at a service provider were used to access Uber data connected to the provider. Uber identified the provider to TechCrunch as Fireworks.ai.
Was my driver’s license information exposed?
TechCrunch reported that breach notices it reviewed include driver’s license information. Uber’s public sample letter leaves the affected-data field blank, so check your own notice for the information Uber says was involved in your case.
How many people were affected?
Uber’s notice lists about 1,873 Rhode Island residents. TechCrunch reported 2,567 people in Massachusetts and 3,430 in South Carolina. The reported figures total 7,870 across those three states, but no national total is available.
What support is Uber offering?
Uber says affected people can get free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must happen within 90 days of the date on the letter.
Has Uber found that the data was misused?
Uber says it has not identified misuse to date. The available information does not establish what the unauthorized party did with the accessed data or whether misuse may be found later.
Source: Thorsten Meyer AI
