Uber Data Breach: Driver Licenses Stolen via Fireworks AI

Uber is notifying thousands of US drivers that their personal and driver’s license information was stolen in October 2026, after hackers compromised Fireworks AI, a third-party artificial intelligence (AI) vendor that held Uber data. The company disclosed the incident in a notice letter dated 10 November 2026 and filed it with several state attorneys general, including California’s.

According to the letter, a service provider told Uber on 9 October 2026 that an unauthorized third party had compromised the provider’s internal credentials and used them to access Uber’s account. Uber says it cut its data connections with the provider straight away. Four days later, on 13 October, its investigation concluded that Uber data connected to the provider had been accessed.

The letter does not name the vendor; however, an Uber spokesperson later did, describing the notices as relating to “a security incident impacting one of our third-party vendors, Fireworks.ai,” TechCrunch reported. Nothing in Uber’s notice suggests the attackers entered Uber’s own systems.

Uber has not given a national figure, but State filings reviewed by TechCrunch put the number at 3,430 people in South Carolina, 2,567 in Massachusetts and 1,873 in Rhode Island, a combined 7,870, with the stolen data including driver’s license information. Uber’s letter also carries notices for residents of the District of Columbia, Maryland, North Carolina, New York and Pennsylvania, and TechCrunch reported that counts for Illinois and California were still outstanding.

How the Fireworks AI breach reached Uber

Fireworks AI, a San Mateo, California company that lets developers run OpenAI models, says it spotted unauthorized use of its internal credentials on 6 October 2026. Its first security bulletin, last updated on 10 October, said the intruder had reached environment variables (stored settings that often hold API keys and passwords) in a limited number of customer accounts, and that it had detected no evidence of access to personal information within its own perimeter.

Uber reached the opposite conclusion about its own data three days after that bulletin was last updated.

The incident then widened. In an update dated 9 November, Fireworks said a cloud provider hosting its research machines suffered a separate security incident on 23 October, and that the same intruder used it a day later to access Fireworks’ development machines, exposing additional customer data. Fireworks says it has notified law enforcement and brought in Palo Alto Networks’ Unit 42 for forensics, and that it does not store payment card numbers.

Fireworks has attributed the attack to a financially motivated criminal group engaged in “LLMjacking”, meaning the theft of credentials to use or resell access to large language models (LLMs). No group has publicly claimed the theft. Uber is not the only customer caught up in it: Notion has confirmed that some AI chat transcripts were exposed, affecting fewer than 1% of its workspaces.

What affected Uber drivers should do

Uber’s letter says the company has “not identified any misuse” of the data so far. It is offering free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Drivers enroll at mytrueidentity.com using the activation code printed in their letter and must do so within 90 days of the letter’s date.

A driver’s license number is hard to change and widely used to verify identity, so recipients should also check their credit reports and consider placing a fraud alert or security freeze with Equifax, Experian, and TransUnion. Drivers who have not received a letter have not been told to take any action.

The incident is Uber’s second known breach of 2026. In August, a hacking group claimed to have taken nearly one million files from Uber Freight, the company’s logistics arm; Uber Freight confirmed unauthorized access to some systems but not that figure.

Uber has not said what it used Fireworks AI for, why driver’s license data was connected to an AI vendor’s platform, or how many people are affected in total. Fireworks did not respond to questions from TechCrunch or Gizmodo, and has not explained how its internal credentials were stolen in the first place.