Uber is notifying thousands of drivers that their personal information, including driver’s license data, was stolen in an October breach tied to one of the company’s technology providers. The incident, first disclosed in notices filed this week with several U.S. attorneys general, adds another high-profile example of how a compromise at a third party can expose customer data far beyond the vendor itself.
What Uber says happened in the breach
According to Uber’s notices, the company was alerted on October 9 by the provider that hackers had broken in and stolen internal credentials. Those credentials were then used to access Uber data stored with the vendor. Uber said it began notifying affected drivers after learning that their personal information had been stored with the provider.
The company did not say how many customers were affected overall, or how many drivers it was notifying in total. Uber also did not identify the provider in the public notices, but TechCrunch reported that the vendor was Fireworks AI, a company that allows developers to access and use open AI models.
Fireworks AI identified as the vendor
TechCrunch said it learned the provider was Fireworks AI, which reported its own data breach last month. In that incident, hackers stole customer information, including billing data and some private AI datasets. Online productivity startup Notion also confirmed that its data was stolen in the Fireworks breach.
Uber told TechCrunch: “The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data,” adding that it was deferring questions to Fireworks. Fireworks, when reached by email, confirmed that it had identified a security issue involving unauthorized access to some of its systems that affected customer data, but it did not directly answer detailed questions about the incident.
What driver data was exposed
Based on breach notices seen by TechCrunch, the stolen information included driver’s licenses belonging to thousands of people in several states. The figures disclosed so far include:
- 2,567 individuals in Massachusetts
- 3,430 people across South Carolina
- 1,873 residents of Rhode Island
An Illinois filing said that some state residents had their driver’s license information stolen, but the total number was still pending. Uber also notified drivers living in California, though it did not say how many were affected there.
The number of impacted drivers is expected to grow as more state breach notifications are filed. That means the figures disclosed so far may not reflect the full scope of the incident.
Why the breach matters for Uber drivers
Driver’s license data is especially sensitive because it can be used to verify identity and, in some cases, help criminals carry out impersonation or fraud. For platform workers such as rideshare drivers, those documents are often stored as part of account verification and compliance requirements, which makes them an attractive target if a vendor is compromised.
This is also a reminder that companies may rely on outside providers for services that still have access to valuable internal data. In this case, Uber said the vendor had access to some Uber information, and the attacker reportedly used stolen credentials to reach it. That sort of supply-chain exposure can make a breach more difficult to contain, especially when multiple customers of the same provider are affected at once.
Fireworks says the attack was financially motivated
Fireworks attributed its breach to a financially motivated cybercriminal group whose aim was to sell stolen tokens used to access large language models, or LLMs. The company has not said which group was responsible, and no known cybercriminal group has publicly taken credit for the theft of data from Fireworks.
The mention of stolen tokens points to a broader problem in the AI tooling ecosystem: access credentials can be valuable on their own, especially when they unlock cloud services, model endpoints, or private datasets. Even when the immediate target is a vendor, the impact can spread to every customer whose data passes through that system.
Uber’s second known breach this year
This is Uber’s second known data breach this year. Earlier, the company reported a security incident at its Uber Freight truck shipping unit, and an extortion gang took credit for stealing data in that case. The new disclosure means Uber is dealing with yet another incident involving unauthorized access to information connected to its business.
While the two incidents involve different parts of the company, they underscore the operational burden that repeated security events can place on a large platform. Each breach can bring separate investigations, state notification requirements, customer support obligations, and reputational fallout.
What affected drivers should watch for
Uber has not publicly detailed any specific steps affected drivers should take, but people whose license information was exposed in a breach typically need to stay alert for signs of identity theft or misuse. Because the stolen data involves government-issued identification, the risk is not limited to account access alone.
Drivers who receive a notice may want to monitor for unusual activity tied to their identity or accounts, keep copies of the notification, and watch for any follow-up communications from Uber or the relevant state authorities. If a breach notice includes identity-protection services or other remediation, those details are usually important to review carefully.
For now, the main unanswered questions are straightforward: how many Uber drivers were affected in total, how much data was stored with the vendor, and whether any additional categories of personal information were exposed beyond driver’s licenses. Those answers may emerge as the state filings continue and as Uber’s notices expand.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: November 13, 2026 at 10:32 pm
0 views
