Uber Data Breach: Drivers’ License Data Stolen Through an AI Vendor. What Drivers Should Do

By Thorsten Meyer | November 14, 2026 | ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

If you drive for Uber in the US, check your mail. Uber has started sending letters to people whose personal information was taken in October, and according to TechCrunch, the stolen data includes driver’s license information. The break-in did not start at Uber. It started at a company Uber shared data with: Fireworks AI, a platform that runs and customizes open AI models for businesses. It is the latest fallout from the Fireworks breach we have followed since November 10, and this time it reaches people who had no say in which vendors handle their data.

Key takeaways

• What Uber confirms: in a notice filed with the California attorney general and dated November 10, 2026, Uber says a service provider told it on October 9 that “an unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.” On October 13, Uber’s investigation found that Uber data had been accessed.
• Which vendor: the notice does not name it. An Uber spokesperson told TechCrunch the incident involves “one of our third-party vendors, Fireworks.ai, which had access to some Uber data”.
• Which data: the public sample letter leaves the data field blank. According to breach notices seen by TechCrunch, the stolen data includes driver’s license information.
• How many: Uber’s own notice says about 1,873 Rhode Island residents were affected. TechCrunch reports 2,567 in Massachusetts and 3,430 in South Carolina. That makes 7,870 people in three states, by our count. There is no national total.
• What affected people get: free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must happen within 90 days of the letter date. Uber says it has “not identified any misuse of your data to date”.

Products Worth Considering

DJI Mini 5 Pro Fly More Combo with DJI RC 2

AmazonView Latest Price

Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite

AmazonView Latest Price

Samsung Odyssey G3 G30D 27-Inch FHD Gaming Monitor

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

What Uber told regulators

Uber’s entry on the California attorney general’s breach list gives October 7, 2026 as the date of the breach and November 10 as the date it was reported. The attached sample letter, headed “NOTICE OF SECURITY INCIDENT”, tells the story in four steps:

• October 9: “a service provider notified Uber” that its internal credentials had been compromised and used against Uber’s account.
• Right after the alert: “Uber immediately severed data connections with the service provider and launched an investigation.”
• October 13: the investigation “determined that the unauthorized party had used the compromised credentials to access Uber data connected to the service provider.”
• November 10: letters go to the people whose “personal information was among the information accessed.”

Note the wording. The notice describes access to “Uber’s account with the service provider” and to “Uber data connected to the service provider”. It does not describe an intrusion into Uber’s own systems.

Reuters, which also read the California filing, pointed out: “The notice did not name the provider or list the data involved.” In the public sample, the field for the affected data is a placeholder that is filled in for each recipient. So the only document that tells a driver exactly which of their data was involved is the letter itself.

The vendor: an AI model platform

The notice keeps the provider anonymous. TechCrunch named it, and Uber confirmed it to the outlet: “The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data.” A Fireworks spokesperson confirmed to TechCrunch that the company had identified a security issue involving unauthorized access to some of its systems that affected customer data.

Fireworks’ own security bulletins describe how its incident began. On October 6, Pacific time, Fireworks “identified a security incident involving unauthorized use of internal Fireworks credentials.” An unauthorized third party “accessed environment variables used in evaluation jobs in a limited number of customer accounts.” On October 7, Fireworks “Started notifying affected customers”. On the evening of October 9, Pacific time, it notified the affected customers it had identified and published its first bulletin.

Those dates line up with Uber’s filing: a breach date of October 7 and an alert on October 9. The bulletins do not name Uber, and neither company has said which Fireworks system held the driver data.

Fireworks has since widened its account. In an update last revised on November 9, it reports “impacts to account and billing information” and, “For a limited set of accounts”, impact to “secrets, datasets, and incomplete models.” Fireworks says the evidence links the activity to a financially motivated cybercriminal group that aims to sell tokens from unauthorized access to large language models, a practice known as “LLMJacking”. No known group has claimed the theft, TechCrunch reports.

We covered how the Fireworks breach widened to datasets and model weights and what Notion found in its affected data earlier this week. This piece stays with Uber and its drivers.

How many drivers are affected

Nobody outside Uber knows yet. Uber “did not say how many customers are affected by the breach, nor how many drivers it was notifying about the incident”, TechCrunch writes. What exists are numbers from state filings:

• Rhode Island: “This incident affected approximately 1,873 Rhode Island residents,” says the addendum to Uber’s own sample letter.
• South Carolina: 3,430 people, according to notices seen by TechCrunch.
• Massachusetts: 2,567 people, according to the same TechCrunch report.
• Illinois: a filing showed that residents had driver’s license information stolen, “but that the number of affected people was pending”, TechCrunch reports.
• California: Uber notified drivers there as well, but did not say how many, according to TechCrunch.

Added up, the three published counts come to 7,870 people. That is a floor, not a total. TechCrunch expects the number “to rise as more data breach notifications roll in.” We could not retrieve the Massachusetts and South Carolina filings directly, so those two figures rest on TechCrunch’s reporting.

What Uber offers, and what drivers should do

Uber’s letter offers credit monitoring and fraud assistance “at no charge”. The service comes from Cyberscout, “a TransUnion company specializing in fraud assistance and remediation services.” The monitoring sends alerts “when changes occur to your credit file”. How many months it runs is left blank in the public sample.

To sign up, you need the activation code printed in your letter, and you must enroll at mytrueidentity.com “within 90 days from the date of this letter.” For a letter dated November 10, that is around February 8, 2027, by our count.

The rest of the letter is the standard identity-protection list:

• Check your accounts and credit reports. Uber recommends that you “regularly review your account statements and monitor free credit reports.” Free reports are available at annualcreditreport.com.
• Consider a fraud alert or a security freeze. A fraud alert tells any merchant checking your credit history to take extra steps to verify an application. “Contacting any one of the three agencies will place an alert on your file at all three.” A security freeze “restricts all creditor access to your account” but can also delay your own new applications. The letter lists Equifax, Experian and TransUnion.
• Report identity theft. The letter points to the Federal Trade Commission at IdentityTheft.gov, to local law enforcement and to your state’s attorney general.
• Ask questions. The sample letter lists a call center at 1-866-317-7961, Monday through Friday, 8:00 a.m. to 8:00 p.m. Eastern time. Its sender line reads “Uber Technologies, Inc. c/o Cyberscout”.

Residents of Pennsylvania who are not eligible for a free credit report can have Uber cover the cost of one report from one credit reporting agency, the letter adds.

What this means for platform companies

A ride-hail platform has to hold identity data. A driver’s license is part of what it takes to drive. The Uber case shows how far that data can travel inside a company’s supply chain: to an outside AI platform, where a vendor’s compromised credentials were enough to reach it.

Three lessons for any company that holds identity data on workers or customers:

1. Your data map has to include AI vendors. Uber says Fireworks “had access to some Uber data”. Uber has not said what for. Any company that tests, evaluates or customizes AI models with outside help should know which vendor holds which records, and whether identity data needs to be there at all.

2. A vendor’s credentials are part of your attack surface. In Uber’s account of events, the way in was the provider’s own “internal credentials”, used to access “Uber’s account with the service provider.” Ask vendors how their staff and systems reach customer accounts, and keep the data you leave with them to the minimum the job needs.

3. Breach notices make the timeline public. Uber cut its data connections “immediately” after the alert and confirmed the data access four days later. The letters followed 32 days after the alert, by our count. The scale then surfaces state by state, filing by filing. In Uber’s case, the public learned about the breach from a regulator’s website and press reports.

What this means for drivers and other gig workers

Drivers did not choose Fireworks. They gave their data to Uber as part of working on the platform, and Uber’s vendor, a company whose name appears nowhere in the letter, ended up with access to some of it. That is how platform work runs today: a worker’s identity data moves through a chain of companies the worker never sees.

A leaked password can be changed in a minute. A driver’s license number usually stays with you for years. That is why the steps in the letter matter. Use the free monitoring, look at your credit reports, and think about a freeze, which, in the letter’s words, “restricts all creditor access to your account”.

Workers on any platform can ask the company which outside providers receive their identity data. Whether they get a clear answer is another question.

What we don’t know

• The total. Uber has not said how many drivers, or other people, were affected nationwide.
• The exact data. TechCrunch reports driver’s license information. The public sample letter does not list the data elements, so which other details were involved, if any, is not public.
• Why Fireworks had the data. Uber says Fireworks “had access to some Uber data” but has not said what the data was used for.
• How the data was reached. In its first bulletin, last updated October 10, Fireworks wrote that it had “not detected evidence of unauthorized access to customer models, datasets, training data, inference traffic (including prompts and outputs), or personal information within the Fireworks security perimeter or control.” Three days later, Uber concluded that its data “connected to the service provider” had been accessed. Neither company has explained how the two statements fit together.
• Misuse. Uber says it has “not identified any misuse” so far. No known group has claimed the theft, according to TechCrunch.
• How long the free monitoring runs. The public sample leaves the number of months blank.

The bottom line

In raw numbers, this breach is small so far. For the drivers in it, it is not. It also shows where identity risk sits now: not only in a company’s own systems, but with the AI vendors it works with. If you drive for Uber in the US, open your mail, use the free monitoring and consider a credit freeze. If you run a platform, the question for this week is simple: which of our vendors holds our people’s identity data, and could one compromised login reach it?

I’m Thorsten Meyer. The full sources are below, and more reality checks are at thorstenmeyerai.com.

Sources

• California Department of Justice, Office of the Attorney General: data security breach entry “Uber Technologies, Inc.” (date of breach October 7, 2026; reported November 10, 2026) and sample notice “NOTICE OF SECURITY INCIDENT”, dated November 10, 2026, oag.ca.gov/privacy/databreach/list
• Fireworks AI: “Fireworks October 2026 security incident”, security bulletin, last updated October 10, 2026, and “Update on October 2026 security incident”, last updated November 9, 2026, fireworks.ai/security/bulletins
• TechCrunch, Zack Whittaker: “Uber confirms hackers stole thousands of drivers’ license information in data breach”, November 13, 2026
• Reuters via CNA: “Uber says US drivers’ license data stolen in data breach”, November 13, 2026

Researched and drafted with AI assistance, including Anthropic’s Claude. No company named here reviewed or sponsored this article. This article is for information only. It is not legal or security-consulting advice. Statements as published by Uber, Fireworks AI and the outlets above as of November 13, 2026; check the California attorney general’s breach list and your own letter for details. Images: AI-generated illustration (Runware) and graphics by Thorsten Meyer AI; no real people or logos are shown.