Uber Warns Thousands of Drivers After Fireworks AI Breach Exposes License Data

Uber is notifying thousands of drivers that their personal information and driver's license details were stolen in an October breach at a third-party technology provider, Fireworks AI. The notices were reported on November 13, 2026, by TechCrunch.

Uber said it was notified on October 9 that hackers had broken in and stolen internal credentials, which were then used to access Uber's data. An Uber spokesperson said the driver notices relate to a security incident affecting Fireworks.ai, a vendor that had access to some Uber data.

The state-level counts reported so far are 2,567 individuals in Massachusetts, 3,430 people in South Carolina, and 1,873 residents of Rhode Island. Uber has filed a breach notice in Illinois stating that some residents had driver's license information stolen, but the number of affected people there is pending. In California, Uber has notified drivers without stating how many were affected.

Fireworks has reported its own breach. According to the company, hackers stole customer information, including billing data and some private AI datasets. Fireworks attributed the intrusion to a financially motivated cybercriminal group seeking to sell stolen tokens, the access keys used to reach large language models (LLMs), the AI systems behind chatbots and similar tools. No known cybercriminal group has claimed responsibility for the theft of data from Fireworks AI. Notion has confirmed that its data was also stolen in the Fireworks AI hack.

The sequence matters for anyone managing third-party risk, the danger that comes from the outside companies you rely on to handle data. Uber's exposure ran through a vendor, not through a direct intrusion into Uber's own systems. The attackers' route was a set of credentials, the digital passwords and keys that prove who is asking for access, and those credentials opened data the vendor held on Uber's behalf.

Vendor access scopes (the range of systems a vendor can reach), credential rotation (regularly replacing passwords and keys), and monitoring of service accounts (automated accounts that software uses to talk to other systems) determine how far one stolen credential can travel. The fact that Fireworks' billing records and AI datasets were taken alongside its customers' information also indicates how much sensitive material sits in the inference and fine-tuning platforms (services that run AI models and adapt them with extra data) that many companies now rely on.

The most important open question is how the attacker moved from the Fireworks environment into Uber data. The state figures will also change as the Illinois count and any California numbers are filed, so the total number of affected drivers may be revised.

In my view, the practical consequence for drivers is that a license number and personal details now sit with at least one criminal group, which raises the risk of identity fraud for an extended period.

The broader context here is that AI platform vendors are now custodians of identity and payment data, and the credentials that unlock them are as valuable to attackers as the datasets themselves.

In my view, the more useful outcome would be tighter scoping of what vendors can reach. That is a change companies can make now, and it would limit the damage the next time a provider is breached.