Uber has told drivers in several U.S. states that hackers stole their personal information — including driver's license data — by breaking into one of its outside technology vendors and using stolen credentials to reach Uber's data, according to a notice dated November 10, 2026, posted on the California attorney general's website and reported by Reuters on Friday, November 13. TechCrunch reported on Friday that the vendor was Fireworks AI, a platform that lets developers run, fine-tune and scale open-source AI models, and that the data taken included drivers' license information.
Source: Reuters
An Uber spokesperson confirmed the connection directly: "The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data." Uber's notice to each affected driver said its investigation concluded that the recipient's personal information was among the information accessed. The case is a textbook example of a supply-chain breach: Uber's own systems were not described as the entry point — the attackers first compromised the vendor, stole its internal login credentials, and then used those credentials to open Uber's account with that vendor.
Source: Neowin (TechCrunch reporting)
The timeline: October break-in, November letters
According to Uber's notice, the provider told Uber on October 9, 2026, that its credentials had been compromised and used to access Uber's account with the provider. Uber said it severed its data connections with the provider and opened an investigation. On October 13, the investigation determined that the unauthorized party had used the credentials to access Uber data, and that the personal information of the notice recipients was among the data accessed. Uber began mailing written notices to affected drivers on November 10 — about a month after it was first told of the compromise.
Source: Reuters
The breach only became public this week, when the state notices surfaced and TechCrunch identified Fireworks AI as the vendor on Friday, November 13. Uber's own notice did not name the provider or list the data involved; the naming of Fireworks AI and the driver's-license detail come from TechCrunch's reporting on the state filings. In an email to TechCrunch, a Fireworks AI spokesperson confirmed the company had identified a security issue involving unauthorized system access that affected customer data, but some of TechCrunch's questions about the incident went unanswered. Uber and Fireworks AI did not immediately respond to Reuters requests for comment.
Source: Neowin (TechCrunch reporting)
How many drivers? The full number is still unknown
State filings discovered by TechCrunch put the confirmed counts at 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island — at least 7,870 drivers in those three states alone. A filing in Illinois showed that some Illinois residents also had driver's license data stolen, but the exact number is not yet known, and Uber also notified drivers in California without saying how many were affected there. Reuters reported that Uber's notice additionally carried instructions for residents of the District of Columbia, Maryland, North Carolina, New York and Pennsylvania. Uber has not announced a nationwide total, so the full scope is expected to grow as more state filings appear.
Source: Neowin (TechCrunch reporting)
Two other questions remain open. Uber has not yet stated whether any of its passengers — riders who have never driven for the company — were affected; so far, the notices are going to drivers. And no cybercrime group has claimed responsibility for the theft. Uber said it had not identified any misuse of the exposed data to date. Driver's license information is valuable to identity thieves because, unlike a password or a payment card, a license number cannot simply be changed, which is why breach notices of this kind come with monitoring offers.
Source: Reuters
Uber is offering affected people free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. You must enroll within 90 days of the date on your letter, using the code in the letter. Uber says it has found no misuse of the data so far — but enrollment is free, and license data can surface months later, so drivers who received a notice should sign up and watch their credit reports.
Who is Fireworks AI, and why did it hold driver data?
Fireworks AI is a developer platform for running and fine-tuning open-source AI models. The company separately reported its own data breach in October, in which threat actors stole customer information including billing data and some private AI datasets. Neither Uber nor Fireworks AI has publicly explained why Uber driver records were stored with an AI vendor, what Uber used the vendor for, or which of the vendor's systems held the license data — questions TechCrunch put to the companies that remain unanswered. What is established is the path: stolen vendor credentials on October 9, confirmed access to Uber data by October 13, and notification letters from November 10.
Source: Neowin (TechCrunch reporting)
This is Uber's second security incident in 2026. In August, the extortion group Helix stole data from Uber Freight, the company's truck-shipping unit, using social-engineering tactics. The two incidents are different in method — one used social engineering against a freight unit, this one used a vendor's stolen credentials — but both reached Uber data through people and partners rather than through a direct assault on Uber's core systems, a pattern security experts call third-party or supply-chain risk.
Source: Neowin (TechCrunch reporting)
What happens next: more state attorney-general filings are likely to add California, Illinois and other state counts to the confirmed 7,870, and Uber may eventually publish a total. Drivers who receive a letter should enroll in the free Cyberscout monitoring within the 90-day window and stay alert for identity-theft signs; drivers who did not receive a letter but believe their data was held by Uber can watch the state filings and Uber's notices for updates. Regulators in the notified states will also be reading the timeline — a month between the October 9 warning and the November 10 letters — as they assess the company's response.