Uber has announced that a data breach has compromised the personal information of numerous U.S. drivers. The breach involved unauthorized access to records held by Fireworks AI, a third-party technology service provider.
Unauthorized Access to Driver Data
The information exposed in this security incident includes driver’s license details. Uber is in the process of notifying those affected, although the total number of impacted individuals across the nation remains undisclosed.
The breach was first reported to Uber on October 9, 2026, when its service provider alerted the company of unauthorized access to internal login credentials. This breach allowed hackers to infiltrate Uber’s account with the provider, leading to the exposure of personal data stored outside of Uber’s systems.
Immediate Response and Investigation
In response, Uber swiftly severed its data connections with the provider and initiated an internal investigation. By October 13, investigators confirmed that the unauthorized party had accessed Uber-related data, prompting breach notifications to be dispatched. The formal notification was dated November 10, 2026.
According to state reports, the breach affected 2,567 individuals in Massachusetts, 3,430 in South Carolina, and approximately 1,873 in Rhode Island, totaling 7,870 people across these states. The full extent of the breach likely involves additional states, given other notifications.
Implications and Protective Measures
While California’s public notice did not specify the exposed data, state filings reviewed by TechCrunch confirmed that driver’s license information was among the compromised records. The breach appears to primarily concern drivers, with no confirmed impact on Uber riders or other accounts.
An Uber representative confirmed the involvement of Fireworks AI in the breach. Previous reports by Cyber Security News highlighted a broader breach at Fireworks AI that affected customer records, although it remains unclear which additional Uber-specific data might have been exposed.
Fireworks AI was also linked to a separate incident involving Notion AI, in which fewer than 1% of customer workspaces were impacted, underscoring how a single provider’s security lapse can affect multiple clients.
Uber’s official breach notice states that no misuse of the affected information has been detected. The company is offering free credit monitoring and fraud assistance through Cyberscout, a TransUnion company, requiring recipients to enroll within 90 days using a provided activation code.
To mitigate potential risks, affected drivers are advised to review their letters, monitor account statements, and report any suspicious activities. Uber further recommends considering fraud alerts or credit freezes, as advised by the Federal Trade Commission, to limit the opening of fraudulent accounts.
