Uber has confirmed a data breach affecting the personal information of thousands of U.S. drivers, after attackers compromised login credentials belonging to Fireworks AI, a third-party technology provider the company works with. The exposed data includes driver’s license information, and Uber has begun sending breach notification letters to affected individuals, though it has not published a total count of how many people nationwide were impacted.

How the Breach Unfolded

According to Uber’s disclosure, the company first learned of the incident on October 9, 2026, when Fireworks AI reported that an unauthorized party had compromised internal login credentials used to access Uber’s account with the service. That access gave the attacker a path into personal records that Uber had stored with the provider, outside of Uber’s own internal systems.

Uber says it responded by immediately severing its data connections to Fireworks AI and launching an internal investigation. By October 13, investigators had confirmed that the intruder had, in fact, accessed Uber-related data — including the personal information now described in notification letters dated November 10, 2026.

Scale of the Exposure

Uber has not released a single nationwide figure for how many drivers were affected, but state-level breach notifications give a partial picture. Filings reviewed from individual states show:

• 2,567 affected individuals in Massachusetts
• 3,430 affected individuals in South Carolina
• Approximately 1,873 affected individuals in Rhode Island

Those three states alone account for roughly 7,870 people, and additional notifications are expected or already underway in other jurisdictions, meaning the true scope is almost certainly larger. Uber’s public filing in California did not specify which exact data fields were exposed, but state regulatory filings reviewed by TechCrunch identified driver’s license information among the compromised records. It’s worth noting that the confirmed evidence so far concerns Uber drivers specifically — it should not be read as indicating that rider accounts generally were affected.

An Uber spokesperson confirmed to TechCrunch that Fireworks AI was the vendor at the center of the incident.

A Pattern of Downstream Exposure

This is not the first disclosure tied to Fireworks AI’s security incident. The provider’s broader breach, covered separately, exposed customer records and datasets tied to multiple organizations that used its infrastructure. Separately, Notion disclosed that chat transcripts handled through the same provider were affected, though Notion emphasized that fewer than 1% of its customer workspaces were touched and that its own internal systems were never breached.

Taken together, these disclosures illustrate a pattern that security teams have been warning about for years: a single compromise at a shared AI or infrastructure vendor can ripple outward into breach notifications at several unrelated companies, each of which trusted that vendor with a different slice of their data. For Uber, the dependency was storing driver identity documents with a provider whose core business is AI infrastructure rather than identity data custody — a reminder that vendor risk assessments need to account for where sensitive data physically lives, not just what a vendor is primarily known for doing.

What Affected Drivers Should Do

Uber’s official breach notice states that, as of the letter’s issue date, the company had not identified any confirmed misuse of the exposed information. Even so, Uber is offering free credit monitoring and fraud assistance through Cyberscout, a TransUnion-owned service. Drivers who received a notice must enroll within 90 days using the activation code included in their letter.

Security experts generally recommend that anyone notified of a breach involving government-issued identification take a few concrete steps:

• Read the specific notification letter carefully, since exposed data fields can vary by state and individual.
• Monitor bank and credit card statements for unfamiliar activity.
• Consider placing a fraud alert or a full credit freeze with the major credit bureaus, which the Federal Trade Commission notes makes it harder for anyone to open new credit accounts using stolen identity details.
• Enroll in the offered credit monitoring service before the 90-day window closes.

Drivers who are unsure whether they were affected should watch for an official letter from Uber rather than responding to unsolicited emails or calls claiming to represent the company — a scenario that breach notifications like this one often get exploited by follow-on phishing attempts.