Uber has confirmed a data breach involving thousands of US drivers after hackers accessed personal information stored with Fireworks AI, a third-party technology provider, including driver's licence details. The company is notifying affected individuals and offering free credit monitoring, but has not disclosed the total number of people affected nationwide.
The breach was reported to Uber on October 9, 2026, after Fireworks AI informed the company that an unauthorised party had compromised internal login credentials. The stolen credentials enabled the attacker to access Uber's account with the vendor and potentially reach records stored outside Uber's own systems.
Uber said it immediately severed data connections with the provider and launched an investigation. By October 13, investigators had confirmed that the attacker accessed Uber data, including personal information belonging to people now receiving breach notifications.
Also Read: US housing aid requires citizenship proof under new Trump administration rule
The notification letter sent to affected individuals is dated November 10.
Uber breach affects thousands across US states
{{/usCountry}}The notification letter sent to affected individuals is dated November 10.
Uber breach affects thousands across US states
{{/usCountry}}State-level disclosures provide an initial picture of the incident's impact. Notices cited by Cyber Security News list 2,567 affected people in Massachusetts, 3,430 in South Carolina and approximately 1,873 in Rhode Island.
Together, the figures account for 7,870 people across the three states. The number does not represent the nationwide total, as additional notifications have been issued elsewhere.
TechCrunch reported that driver's licence information was among the compromised records, citing state filings. Uber also confirmed to the publication that Fireworks AI was the third-party vendor involved.
Also Read: California restaurant removes sign marking Nvidia’s founding after Jensen Huang exit
The breach disclosures primarily concern drivers. The available information does not establish that all Uber riders or customer accounts were affected.
Fireworks AI breach raises concerns over third-party data security
The incident also draws attention to security risks associated with companies relying on external technology providers to process or store information.
Fireworks AI was previously linked to disclosures involving customer records and datasets, according to Cyber Security News. The provider also handled data connected to a separate Notion AI chat transcript breach.
Notion said fewer than 1% of customer workspaces were affected and that its own systems had not been breached. The incidents involve separate customers and disclosures; they do not establish that Notion data or other customer information was accessed through Uber's breach.
Uber offers credit monitoring to affected drivers
Uber said it had not identified misuse of the compromised information when its notification letters were issued. The company is offering affected individuals free credit monitoring and fraud assistance through Cyberscout, a TransUnion company.
Recipients must enrol within 90 days of the November 10 letter using the activation code provided in their notification.
Uber has advised affected drivers to review their account statements, monitor for suspicious activity and consider additional safeguards, including fraud alerts or credit freezes.
The Federal Trade Commission says a credit freeze restricts access to credit reports, making it harder for criminals to open new accounts using stolen personal information.
The company has not publicly disclosed the full number of affected drivers or provided a nationwide breakdown of the compromised records.