Fireworks AI, a provider that gives developers access to open-source AI models, was the breach point. Uber confirmed the intrusion in notifications sent to drivers across multiple states, and the total number of affected people remains unknown.
What the Filings Show
State breach notices confirm at least 7,870 affected residents across three states, and filings in Illinois, California, and several other jurisdictions suggest that figure may rise.
TechCrunch’s review of state filings identified 2,567 Massachusetts residents, 3,430 South Carolina residents, and 1,873 Rhode Island residents who received notifications about their driver’s-license data. Uber’s notices also addressed residents of Illinois, California, the District of Columbia, Maryland, North Carolina, New York, and Pennsylvania, with several state counts still pending or unpublished. Uber has not released a national total.
How Stolen Credentials Became a Data Breach
Hackers used compromised Fireworks AI credentials to reach data Uber had stored with the vendor; Uber learned of the intrusion on October 9 and confirmed data access four days later.
Fireworks AI alerted Uber on October 9 that attackers had broken in using stolen internal credentials. Uber severed its data connections with the provider and determined on October 13 that personal information had been accessed, according to Reuters.
The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data.
Uber spokesperson, via TechCrunch
Who Was Behind the Attack
Fireworks AI attributed the intrusion to a financially motivated group, though no cybercriminal organization has publicly claimed responsibility.
Fireworks AI confirmed that unauthorized access affected some customer data and attributed the intrusion to a group seeking to sell stolen AI-model access tokens. Compromised information at Fireworks also reportedly included customer billing data and, for a limited number of accounts, private datasets , a pattern reminiscent of apps secretly tracking users without their knowledge. Uber said it had not identified confirmed misuse of driver data as of the time of reporting.
What Uber Is Offering Affected Drivers
Free credit monitoring through Cyberscout is available, but the enrollment window is 90 days from the date of the notification letter.
Uber is providing affected individuals with credit monitoring and fraud assistance through Cyberscout, a TransUnion company. That 90-day enrollment window runs from the date of the letter, so recipients should act promptly. Any follow-up message requesting payment, credentials, or license information should be treated as potential fraud , readers looking for broader guidance on how to stay safe against data and identity risks will find additional steps worth reviewing.
Two Breaches in One Year Points to a Structural Problem
This is the second publicly known Uber security incident reported in 2026, and credit monitoring does not address the underlying failure.
Earlier this year, an extortion group claimed responsibility for a breach involving Uber’s Freight unit. Two separate incidents in one year moves the conversation from misfortune to accountability.
The core failure here is not complicated. Companies that require government-issued ID to onboard workers carry a clear obligation. They must minimize what they retain, restrict what vendors can access, and enforce rapid-notification clauses in every supplier contract. Driver’s-license numbers stored in an AI infrastructure provider’s environment, reachable through compromised credentials, represent exactly the kind of data-minimization gap the industry should be closing. Affected drivers should enroll in the offered monitoring service before that 90-day deadline passes and remain skeptical of any unsolicited contact referencing the breach.
