Uber Vendor Breach Exposes Drivers' License Data

Uber is notifying drivers across the United States that their personal information was accessed in a breach at a third-party service provider. The company's notice, dated November 10, 2026, and posted on the California attorney general's website, says the provider reported on October 9 that its internal login credentials had been compromised.

The attack vector was the vendor's account itself. The unauthorized party used the stolen credentials to reach Uber's account with the provider, and Uber severed its data connections with the provider and opened an investigation. By October 13, investigators had confirmed the party reached Uber data, and that recipients' personal information sat inside it.

Uber's notice doesn't name the provider or list the data fields. TechCrunch reported on November 13 that the provider was Fireworks AI, a platform that runs open AI models for developers, and an Uber spokesperson confirmed the notices concern a Fireworks AI incident. The data identified in state filings is driver's license information.

The known count is partial. Filings list 3,430 people in South Carolina, 2,567 in Massachusetts and 1,873 in Rhode Island, a combined 7,870 drivers. Drivers in California and Illinois were also notified, but those counts aren't public, and Uber hasn't given a national total. Nothing in the notices so far points to rider accounts.

Uber says it hasn't identified any misuse of the data to date. It's offering affected drivers free credit monitoring and fraud assistance through Cyberscout, a TransUnion company, and recipients have 90 days from their letter to enroll. Drivers who get a letter should enroll, freeze their credit and watch for license misuse, because license numbers don't change when a breach does.

The open question is the vendor's job. Uber hasn't explained why driver's license records sat within an AI provider's reach, and Fireworks AI has confirmed unauthorized access to its systems without answering the Uber-specific questions. Until that answer lands, drivers know their data was exposed. They don't know why it was there.