TL;DR
Uber says an unauthorized party used a service provider’s compromised credentials to access Uber data held by that provider. Uber identified Fireworks.ai as the vendor, and TechCrunch reports that breach notices to some people include driver’s license information. The total number of affected people nationwide is not known.
Uber is notifying people that an unauthorized party accessed Uber data through a third-party vendor, which the company identified to TechCrunch as Fireworks.ai. TechCrunch reports that breach notices include driver’s license information; Uber’s public sample letter does not specify the data involved, so recipients must check their individual notices to learn what information about them was affected.
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Uber’s sample notice, filed with the California attorney general and dated November 10, says a service provider told Uber on October 9 that an unauthorized third party had compromised the provider’s internal credentials and used them to access Uber’s account with that provider. Uber says it cut its data connections with the provider and began investigating. By October 13, the investigation had found that Uber data connected to the provider was accessed.
The filing does not name the vendor or identify the data. Uber’s spokesperson told TechCrunch that the incident involved Fireworks.ai, which had access to some Uber data. A Fireworks spokesperson separately confirmed to the outlet that the company had identified unauthorized access to some of its systems affecting customer data. TechCrunch says breach notices it reviewed include driver’s license information. The public sample letter leaves the affected-data field blank for details to be filled in for each recipient.
Uber’s notice says about 1,873 Rhode Island residents were affected. TechCrunch reports 2,567 in Massachusetts and 3,430 in South Carolina. Together, those figures amount to 7,870 people across three states, but they do not establish a nationwide total. Uber is offering free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. The notice says enrollment must take place within 90 days of the letter date.
Why Vendor Access Matters
The incident shows how information shared with a service provider can become part of a company’s data exposure, even when the reported access route is through the provider’s credentials. Uber’s notice describes access to its account with the provider and data connected to that service. It does not describe an intrusion into Uber’s own systems.
For affected drivers and other recipients, the type of data matters. Driver’s license information can be used in attempts at identity fraud, although Uber says it has not identified misuse to date. Its offer of credit monitoring and fraud assistance gives recipients a way to seek support, while the 90-day enrollment deadline makes checking the letter promptly relevant.
The reported state figures also provide only a partial view. The three figures cited in the source material add up to thousands of people, but no national count is available. Readers should treat the total as a count across those named states, not as the full scale of the incident.
Products Worth Considering
DJI Mini 5 Pro Fly More Combo with DJI RC 2
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Samsung 27-inch Odyssey OLED G6 QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Vendor Credentials to Notices
Fireworks AI provides a platform businesses use to run and customize open AI models. Uber’s notice refers to a service provider without naming it; the identification of Fireworks came later, when Uber spoke to TechCrunch. The reporting therefore draws on several kinds of source: Uber’s filing and sample notice, statements from Uber and Fireworks to TechCrunch, and breach notices reviewed by the outlet.
Fireworks’ security bulletins say the company identified an incident involving unauthorized use of internal credentials on October 6, Pacific time. The bulletin says an unauthorized third party accessed environment variables used in evaluation jobs in a limited number of customer accounts, and that Fireworks started notifying affected customers on October 7. Uber’s notice places its own alert from the service provider on October 9 and says its investigation found Uber data access on October 13. These dates describe the reported sequence; the public material does not detail the full technical path between the vendor incident and the Uber account.
Uber’s California filing lists October 7 as the breach date and November 10 as the report date. Its sample notice says letters were dated November 10. TechCrunch reported on November 13 that driver’s license information was included in notices and that Uber named Fireworks.ai as the vendor.
““an unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.””
— Uber, in its sample notice
What Recipients’ Letters Specify
The public sample letter does not list the affected data; that field is left for individual recipient details. TechCrunch reports that notices it reviewed include driver’s license information, but the available material does not establish that every person notified had that same information accessed. Recipients need to consult their own letters for the data identified in their case.
There is no nationwide total in the source material, and the figures for Rhode Island, Massachusetts, and South Carolina do not show how many people elsewhere may have been affected. The sources also do not say what the unauthorized party did with the accessed data or identify that party. Uber says it has not identified misuse to date. That statement does not settle whether misuse could be found later.
Check the Notice and Deadline
People who receive an Uber security notice should read its individual data field and follow the instructions for the free Cyberscout monitoring and fraud assistance. Uber says enrollment must be completed within 90 days of the letter date. The sample notice is dated November 10, 2026, but recipients should use the date and directions in their own correspondence.
Further details may come from Uber, Fireworks, state breach filings, or reporting as the companies clarify the scope and response. For now, the confirmed public account establishes that Uber data was accessed through a provider account and that Uber cut its data connections after being alerted. The national number affected, the precise information involved for each recipient, and any later finding of misuse remain unsettled in the supplied material.
Key Questions
Was driver’s license information exposed?
TechCrunch reports that breach notices it reviewed include driver’s license information. Uber’s public sample letter leaves the affected-data field blank, so recipients should check their own notice to see which information was involved in their case.
Did Uber say its own systems were breached?
Uber’s notice says the unauthorized party used a provider’s compromised internal credentials to access Uber’s account with that provider and Uber data connected to it. The notice does not describe an intrusion into Uber’s own systems.
How many people were affected?
Uber’s notice gives about 1,873 people in Rhode Island. TechCrunch reports 2,567 in Massachusetts and 3,430 in South Carolina. Those figures total 7,870 across three states; a nationwide total is not available in the source material.
What support is Uber offering?
Uber says affected people can receive free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must take place within 90 days of the letter date.
Has Uber identified misuse of the data?
Uber’s sample notice says it had “not identified any misuse of your data to date.” The public material does not say what the unauthorized party did with the accessed data.
Source: Thorsten Meyer AI
