Uber has confirmed that hackers stole personal information and driver’s license records belonging to thousands of drivers after compromising a third-party technology provider. The Uber data breach occurred in October 2026, but affected drivers began receiving formal notifications in November.
The incident involved Fireworks AI, an artificial intelligence infrastructure company that processes data for business customers. Attackers obtained internal credentials belonging to the provider and used them to access information connected to Uber’s account.
Regulatory disclosures identify at least 7,870 affected people across Massachusetts, South Carolina and Rhode Island. Additional drivers in California and Illinois were also notified, although the total number affected remains undisclosed.
Uber Data Breach Exposes Driver Information Across Several States
State notifications show that the breach affected 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island. These figures represent a minimum number of affected individuals, not the full extent of the incident.
Uber also reported affected residents in Illinois and California but did not provide final numbers for those states. The company has not disclosed a nationwide total.
According to a breach notification published by the California Attorney General, the security incident occurred on October 7. Uber learned of the unauthorized access on October 9, when its service provider reported that internal credentials had been compromised.
Uber immediately disconnected its systems from the affected provider and opened an investigation. By October 13, investigators had determined that the stolen credentials had been used to access Uber information.
The exposed records included driver’s license information and other personal data. The company has not publicly provided a complete breakdown of the information stolen from every affected driver.
Fireworks AI Breach Also Affected Other Technology Customers
The attackers gained access through Fireworks AI rather than directly breaching Uber’s primary systems. The provider operates infrastructure that allows businesses to deploy and use artificial intelligence models.
Fireworks previously disclosed unauthorized access to customer information, including billing records and certain private AI datasets. The company attributed the intrusion to financially motivated cybercriminal activity involving unauthorized access to large language models.
The same security incident also affected workplace software company Notion. As TechAmerica previously reported, the Fireworks compromise exposed Notion AI conversation transcripts associated with fewer than 1% of its workspaces.
Notion disconnected the provider and suspended its Insights feature after discovering that some customer conversations had been retained in external infrastructure.
Uber’s exposure involved a different category of information. Instead of AI chat transcripts, attackers obtained identity records connected to drivers using the ride-hailing platform.
Fireworks has acknowledged that unauthorized access to its systems affected customer data. The company has not publicly described the full impact on all affected business customers.
Uber Offers Credit Monitoring to Affected Drivers
Uber is notifying drivers whose information investigators identified as compromised. Its November 10 notification states that affected individuals can enroll in complimentary credit monitoring and fraud assistance services.
The protection is being provided through Cyberscout, a TransUnion company. Recipients must use the activation information supplied in their individual notification and enroll within 90 days of the letter.
Uber said its investigation had not identified misuse of the exposed information when it prepared the notices. However, the absence of identified misuse does not establish that stolen records will remain unused.
Driver’s license information can be particularly sensitive because it contains government-issued identifiers. Criminals may attempt to combine such records with other personal information for identity fraud or impersonation.
TechAmerica previously covered an IDScan security incident involving driver’s license and passport records, highlighting the risks associated with companies storing large collections of identity documents.
Uber has advised affected individuals to review financial accounts, monitor credit reports and report suspicious activity. Recipients can also consider fraud alerts or credit freezes if they believe their information could be misused.
Third-Party Security Risks Remain Under Investigation
The Fireworks incident is Uber’s second publicly reported data breach in 2026. Earlier this year, its Uber Freight division experienced a separate security incident involving claims of stolen information.
No established connection links the Uber Freight incident to the October Fireworks compromise.
The latest breach illustrates how attackers can reach customer records through external technology providers. Compromised credentials may allow unauthorized access to information shared with those services, even when the customer’s main systems are not directly breached.
Uber has not disclosed how many drivers were affected nationwide or whether additional regulatory notifications will follow. Fireworks continues examining the security incident, while the full extent of the stolen information remains unresolved.
