Uber has confirmed a data breach tied to records held by Fireworks AI, a third-party technology provider, and the incident affected thousands of U.S. drivers. The exposed information included driver’s license details, while Uber has not disclosed the total number impacted nationwide.
Uber says it learned of the incident on October 9, 2026, when its service provider reported that an unauthorized party had compromised internal login credentials. Those credentials gave the attacker access to Uber’s account with the provider, which opened a path to personal records stored outside Uber’s own systems. Uber then cut its data connections with the provider and opened an investigation. On October 13, investigators confirmed that the attacker had accessed Uber data, including personal information belonging to people now receiving breach notices.
State notices and the scale of the breach
State notices show that the breach affected 2,567 people in Massachusetts, 3,430 in South Carolina, and approximately 1,873 in Rhode Island. Together, those figures total 7,870 people across three states. Additional notifications involve other states, so that number does not reflect the full scale of the breach.
The public California notice leaves the exposed data fields blank rather than listing specific information. State filings reviewed by TechCrunch identified driver’s license information among the stolen records. The available evidence concerns drivers and does not confirm that all Uber riders or accounts were affected.
What the provider links showed
An Uber spokesperson confirmed to TechCrunch that Fireworks AI was the vendor involved. Cyber Security News had previously covered the broader Fireworks AI data breach, which exposed customer records and some datasets. Those broader findings do not establish which additional data, if any, belonged to Uber.
The same provider also handled data involved in the Notion AI chat transcript breach. Notion said fewer than 1% of customer workspaces were affected and that its own systems were not breached. These separate disclosures show that one provider’s security incident can expose information belonging to several customers.
Notice to affected drivers
Uber’s official breach notice says it had not identified misuse of the affected information when the letter was issued. The company is offering free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Recipients must enroll within 90 days of the letter’s date using their activation code.
Affected drivers are told to review their individual letters, check account statements, and report suspicious activity. Uber also recommends considering fraud alerts or credit freezes. The Federal Trade Commission says a credit freeze limits access to credit reports, making fraudulent new accounts harder to open.
Licensed under CC BY-ND 4.0 International