Uber has confirmed that hackers stole driver’s license information belonging to thousands of its drivers after breaching Fireworks AI, a third party AI infrastructure vendor. Uber said its provider notified it on October 9 that attackers had stolen internal credentials later used to access Uber data, according to TechCrunch.
Fireworks AI, which sells developers access to open AI models, disclosed its own breach the previous month covering customers’ billing data and some private AI datasets. Notion separately confirmed on November 13 that the same Fireworks AI breach exposed some of its own customers’ AI chat transcripts, a story Praman reported earlier this week.
How many drivers are affected
Uber has not disclosed a single nationwide total. Breach notices filed with US state attorneys general, reviewed by TechCrunch, show 2,567 affected individuals in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island. A count for Illinois is still pending, and Uber notified drivers in California without disclosing a number there.
TechCrunch noted the figures will likely rise as more states receive notifications in the coming weeks, since breach disclosure laws require separate filings in each jurisdiction.
What data was stolen
The stolen records include drivers’ personal information and driver’s license details. Uber’s spokesperson described it to TechCrunch as “a security incident impacting one of our third-party vendors” and referred further questions to Fireworks AI.
Fireworks AI confirmed “unauthorized access to some of its systems” affecting customer data, but did not answer TechCrunch’s specific questions about the scope of the Uber-related theft. No hacking group has publicly claimed responsibility for the data theft, though Fireworks attributed the breach to a financially motivated cybercriminal group that is known for selling stolen access tokens for large language models.
Uber’s second breach disclosure this year
This is Uber’s second known data breach disclosure in 2026. An earlier incident involved Uber Freight, where a separate extortion gang claimed credit for stealing data from that business unit. The two breaches are not described as connected in Uber’s public statements, and they involve different business units and different attackers.
Together, the two 2026 incidents mean Uber has had to send breach notifications tied to two separate root causes within the same year, once through its freight logistics arm and once through an AI vendor used elsewhere in the company. Uber has not said whether it is reviewing its use of other third-party AI vendors as a result.
What it means for the AI vendor supply chain
Uber and Notion are now both confirmed customers whose data was exposed through the same Fireworks AI breach, a sign that a single AI infrastructure vendor’s security lapse can cascade into unrelated companies’ customer and driver data. Fireworks AI has not published a full list of affected customers.
Companies that route customer data through third party AI model providers are facing growing scrutiny over how much access those vendors retain, and how quickly a single stolen credential can expose data belonging to several unrelated businesses at once.
Why stolen driver’s license data is a bigger risk than a password leak
Unlike a stolen password, a driver’s license number cannot simply be reset. Security researchers generally treat government-issued ID data as higher risk than login credentials, since it can be used for identity theft, fraudulent account openings or impersonation long after a breach is disclosed. Uber’s notification letters, filed with state attorneys general, typically recommend drivers monitor their credit reports and watch for unfamiliar accounts opened in their name.
US data breach notification laws require companies to file separate disclosures in every state where affected residents live, which is why the confirmed numbers so far are scattered across Massachusetts, South Carolina, Rhode Island, Illinois and California rather than published as one national figure.
What happens next
Uber is continuing to notify affected drivers as more state filings are completed, and the overall number of drivers impacted is expected to grow. Fireworks AI has not said whether its October breaches, reported as occurring on October 6 and October 23 to 24, are fully contained.
Frequently asked questions
Was Uber itself hacked directly?
No. Uber said the breach originated at Fireworks AI, a third-party vendor, and attackers used stolen credentials from that vendor to reach Uber-related data.
How many Uber drivers are affected in total?
Uber has not disclosed a single nationwide number. State filings reviewed by TechCrunch show at least 2,567 in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island, with more states expected to report figures.
Is this related to the Notion breach reported this week?
Yes. Both incidents trace back to the same breach at Fireworks AI, though the specific data exposed differs between Uber drivers and Notion customers.
Leave a Reply