TL;DR
Uber says a third-party provider’s compromised credentials were used to access Uber data held by the provider. Uber has started notifying affected people, and TechCrunch reports that the stolen data includes driver’s license information. The notices name no national total; Uber reports about 1,873 affected Rhode Island residents, with additional state counts reported by TechCrunch.
Uber has begun sending breach notices to people whose personal information was accessed through a third-party provider, after the provider told the company on October 9 that its internal credentials had been compromised. Uber’s public sample notice does not specify the data involved, but TechCrunch reported November 13 that the stolen information includes driver’s license data.
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Uber’s notice, filed with the California attorney general and dated November 10, says an unauthorized third party used compromised credentials to access Uber’s account with a service provider. Uber says it severed its data connections with the provider after receiving notice and opened an investigation. By October 13, that investigation had found that the attackers accessed Uber data connected to the provider.
The California filing does not identify the provider. An Uber spokesperson told TechCrunch that the incident involved Fireworks.ai, which the spokesperson described as a third-party vendor with access to some Uber data. A Fireworks spokesperson told the outlet the company had identified unauthorized access to some of its systems that affected customer data.
The sample letter Uber filed leaves the affected-data field blank for each recipient’s details. TechCrunch reported that breach notices it reviewed included driver’s license information. Uber says its notice covers about 1,873 Rhode Island residents. TechCrunch reported 2,567 people in Massachusetts and 3,430 in South Carolina. Those reports total 7,870 across the three states, but no national figure is available in the material published so far.
What Drivers Should Check Now
Driver’s license information can be used in attempts at identity fraud. People who receive an Uber notice should read the letter to learn which specific data Uber says was involved and follow its enrollment instructions. Uber says affected recipients can access free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Enrollment must be completed within 90 days of the letter date.
Uber says it has not identified misuse of the data to date. That statement describes what the company has found so far; it does not establish that misuse is impossible or that every recipient faces the same risk. The difference between the general sample letter and the recipient-specific notice also matters: the public filing does not tell every driver which information was accessed.
The reported route into the data also puts attention on vendor access. Uber’s filing says the compromised credentials were used against its account at the provider and that data connected to the provider was accessed. It does not describe an intrusion into Uber’s own systems. For affected drivers, the immediate practical step is to check the mailed notice and use the assistance offered within the stated enrollment period.
Popular right now
Dyson V8 Cordless Vacuum
Ninja Foodi DZ201 8-Quart DualZone 6-in-1 Air Fryer
Roborock Q7 L5 Robot Vacuum and Mop Combo
As an affiliate, we earn on qualifying purchases.
How the Vendor Connection Was Compromised
Uber’s California filing gives October 7, 2026, as the breach date and November 10 as the date reported to the state. The attached notice says the provider alerted Uber on October 9. Uber then severed its data connections with the provider and began investigating, with its investigation finding access to Uber data on October 13.
Fireworks’ security bulletins provide a separate account of the vendor’s incident. The company said it identified unauthorized use of internal credentials on October 6, Pacific time, and that a third party accessed environment variables used in evaluation jobs in a limited number of customer accounts. Fireworks said it began notifying affected customers on October 7. Uber’s notice does not name Fireworks; Uber’s identification of the vendor came in a statement to TechCrunch.
The reporting links the Uber notices to the Fireworks incident, but the available material does not explain precisely which Uber data was stored or accessed through the vendor for each recipient. The individual letters are the source Uber directs recipients to for that information.
““an unauthorized third party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider.””
— Uber’s notice to affected people
What the Notices Do Not Specify
The national number of affected people is unknown. The source material gives a state count in Uber’s filing for Rhode Island and additional state counts reported by TechCrunch for Massachusetts and South Carolina. It does not provide a complete U.S. total.
The public sample letter does not identify the data involved, and Uber’s filing does not list it. TechCrunch reports that driver’s license information appears in notices it reviewed, but each recipient’s letter is needed to determine what Uber says was accessed in that person’s case. The available accounts also do not explain what the accessed data was used for. Uber says it has not identified misuse to date.
Read the Notice and Enroll
People who receive a letter should check its recipient-specific details and follow the instructions for the free Cyberscout monitoring and fraud assistance. The stated enrollment deadline is 90 days from the date on the letter. Uber’s notice says it severed its data connections with the provider and investigated the access. The source material does not give a further investigation milestone or a date for a complete national count.
Key Questions
What happened to Uber’s data?
Uber says a third party used a service provider’s compromised internal credentials to access Uber data connected to the provider. Uber found the data had been accessed during its investigation.
Was Fireworks.ai the provider?
Uber identified Fireworks.ai to TechCrunch as the vendor involved. The California filing itself does not name the provider.
Was driver’s license information exposed?
TechCrunch reported that breach notices it reviewed included driver’s license information. Uber’s public sample notice leaves the affected-data field blank, so recipients should check their own letter for the details Uber provides.
How many people were affected?
Uber’s notice says about 1,873 Rhode Island residents were affected. TechCrunch reported counts of 2,567 in Massachusetts and 3,430 in South Carolina. The material does not establish a national total.
What assistance does Uber offer?
Uber’s notice offers free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Recipients must enroll within 90 days of the date on their letter.
Source: Thorsten Meyer AI
