Uber has confirmed that personal information belonging to thousands of its drivers was stolen after hackers accessed company data through a compromised third-party technology provider. The incident involved Fireworks AI, a cloud-based artificial intelligence platform that provides developers with access to AI models. According to breach notifications filed with several US state authorities in November 2026, the stolen information included drivers’ licence details and other personal information. The incident originated from a security breach at the external provider rather than a direct intrusion into Uber’s primary systems.
The breach became public on November 13, 2026, after TechCrunch reported that Uber was notifying affected drivers about the incident. The available state filings identify 2,567 affected individuals in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island, bringing the confirmed number across those three states to 7,870. Additional notifications have been filed in California and Illinois, but the total number of affected individuals nationwide has not yet been established.
How Hackers Accessed Uber Drivers’ Information
The security incident originated at Fireworks AI, a technology provider that gives developers access to open-source artificial intelligence models and related cloud infrastructure.
According to Uber’s disclosures, the company was informed by the provider on October 9, 2026, that hackers had compromised internal credentials. Those credentials were subsequently used to access Uber-related information stored through the provider’s systems.
Uber disconnected its data connections with the service provider and launched an investigation.
By October 13, the investigation had established that the compromised credentials had been used to access Uber data and that personal information belonging to individuals was involved.
TechCrunch identified Fireworks AI as the affected vendor and reported that the exposed information included drivers’ licence details.
The incident demonstrates how security weaknesses at an external technology provider can expose sensitive information belonging to customers and employees of much larger companies.
Nearly 7,900 Individuals Identified Across Three States
The breach notifications submitted to US authorities provide an initial picture of the incident’s scale.
According to the filings reported by TechCrunch, thousands of individuals across multiple states had their personal information exposed.
| US state | Reported affected individuals |
|---|---|
| South Carolina | 3,430 |
| Massachusetts | 2,567 |
| Rhode Island | 1,873 |
| Total across these states | 7,870 |
Illinois has also received a notification indicating that residents were affected, although the number was still pending in the filing.
Uber also notified drivers in California, but the company did not disclose the number of affected individuals there.
The 7,870 figure should therefore be treated as a subtotal from three identified states, not the final nationwide impact. The total could increase as additional notifications become available.
What Information Was Stolen?
The exposed information included drivers’ licence details and other personal information stored through the third-party provider.
Driver’s licence information is particularly sensitive because it can be used in identity-related fraud and other unauthorised activities.
Uber has not publicly provided a complete breakdown of every affected data field or the total number of records involved.
The company also has not established that the stolen information has been used for identity theft or other fraudulent activities.
This distinction is important: confirmation that information was accessed or stolen does not automatically mean that attackers have successfully used it.
Fireworks AI Also Experienced a Wider Security Incident
The Uber incident is connected to a broader security breach at Fireworks AI.
Fireworks provides infrastructure that allows developers and businesses to access and run artificial intelligence models. Its services are used by companies building AI-powered applications and products.
According to TechCrunch, Fireworks experienced a security incident in October during which attackers accessed customer information, including billing data and certain private AI datasets.
The company attributed its incident to a financially motivated cybercriminal group. The reported objective was to obtain and sell credentials or tokens that could be used to access large language models.
Online productivity company Notion also confirmed that some of its data was stolen in the Fireworks incident. Its exposure included anonymised chat transcripts associated with Notion AI customers.
The involvement of multiple technology companies illustrates how a single vendor security failure can affect organisations that rely on the same infrastructure provider.
Uber Offers Free Credit Monitoring to Affected Drivers
Following the discovery, Uber began notifying individuals whose personal information was involved in the incident.
The company is offering affected individuals free credit monitoring and fraud assistance through Cyberscout, a TransUnion company.
According to the breach notification, recipients have 90 days from the date of their individual notification letter to enrol in the service.
Uber has also said it has not identified evidence of misuse of the exposed information so far.
For affected drivers, the credit-monitoring service is intended to help identify suspicious activity that could indicate attempted identity theft or financial fraud.
Individuals receiving an official notification should review the instructions carefully and enrol within the specified period.
Why Third-Party Vendor Security Is Becoming a Major Risk
The Uber incident highlights a growing cybersecurity challenge for companies using external AI infrastructure and cloud service providers.
Large businesses increasingly rely on third-party platforms for data processing, analytics, customer support and artificial intelligence applications. These integrations can improve efficiency and reduce development costs, but they also create additional points of vulnerability.
A company may maintain strong security across its own systems while still facing exposure through a supplier that has authorised access to its information.
The incident raises several important security concerns:
- Credential protection: Compromised internal credentials can provide attackers with access to connected company data.
- Third-party access: External vendors may hold sensitive information belonging to multiple customers.
- Data minimisation: Companies need to limit the amount of personal information shared with external providers.
- Vendor monitoring: Businesses must regularly review the security practices of technology suppliers.
- Incident response: Organisations need procedures to quickly disconnect compromised integrations and notify affected individuals.
As companies adopt more AI services, these risks are likely to become increasingly important.
The Bigger Picture
The Uber breach shows that cybersecurity risks are no longer limited to a company’s own infrastructure. Businesses increasingly depend on interconnected networks of cloud providers, AI platforms and software vendors, creating additional pathways through which sensitive information can be exposed. Even when an external provider is responsible for the initial security failure, the consequences can extend to customers, employees and business partners of multiple organisations.
The incident also highlights the importance of security controls around AI infrastructure. As businesses integrate large language models and external AI services into their operations, protecting credentials, limiting data access and monitoring vendor activity will become essential. Companies will need to treat third-party AI providers as an important part of their cybersecurity risk-management strategy rather than simply as technology suppliers.
Looking Ahead
Uber is continuing to notify affected individuals and provide access to credit monitoring and fraud assistance. The final number of affected drivers remains uncertain because some state notifications do not yet include complete figures. Further disclosures from Uber and Fireworks AI could provide additional information about the compromised records, the full scope of the incident and the security measures introduced following the breach.
For the broader technology industry, the incident is another reminder that outsourcing AI workloads does not remove responsibility for protecting sensitive information. Companies using external AI infrastructure will face growing pressure to strengthen vendor assessments, restrict access to personal data and establish faster incident-response procedures. As AI adoption expands, third-party security is likely to become an increasingly important consideration for businesses and regulators.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
