The Uber data breach disclosed on 13 November 2026 took driver’s license information from thousands of US drivers, through a third-party vendor called Fireworks AI. State filings show at least 7,870 drivers affected across Massachusetts, South Carolina and Rhode Island. Uber began sending notification letters on 10 November 2026.
The intrusion did not happen on Uber’s own systems. Attackers took internal credentials from Fireworks AI, a San Francisco company that gives developers access to open artificial intelligence models, and used them to reach data held in Uber’s account there. Drivers who receive a letter have a deadline attached to it, and most coverage of the breach has not mentioned it.
How Many Drivers Were Affected
There is no official national total. Uber has not published one, and the figure circulating in coverage is a sum of individual state filings rather than a number Uber or any regulator has issued.
| State | Residents affected |
|---|---|
| South Carolina | 3,430 |
| Massachusetts | 2,567 |
| Rhode Island | 1,873 |
| Illinois | Filing pending; count not published |
| California | Notice filed 10 November 2026; count not published |
| Known total | At least 7,870 |
The count will almost certainly rise. Because US breach-notification law requires filings state by state, the published numbers appear piecemeal, and states with pending filings are not yet represented. Uber has not said how many drivers it is notifying in total.
What Drivers Should Do Now
The one deadline that matters is 90 days from the date printed on the notification letter. Uber is offering free credit monitoring and fraud assistance through Cyberscout, and enrolment is not automatic.
- Find the activation code: Each notification letter carries a unique enrolment code. Without it, the free monitoring cannot be activated.
- Enroll within 90 days: The window runs from the date of the letter, not from the date of the breach or the date it was reported.
- Read the data field on your own letter: Reporting indicates driver’s license information was taken, but the specific fields are listed on each individual notice.
- Check statements and credit reports: Uber is recommending that affected drivers review account statements and monitor credit reports for suspicious activity.
- Consider a fraud alert or credit freeze: A freeze makes it harder for someone to open a new account in your name. Note that a credit freeze does not protect a driver’s license number itself, which is a problem identity-document breaches raise repeatedly.
- Treat follow-up contact with suspicion: Unexpected calls, texts or emails referring to the breach are a common second stage after identity documents are stolen, as drivers were advised after the Revolut passport-copy breach.
Uber says it has not identified any misuse of the information to date.
Two Intrusions in October, Eighteen Days Apart
Fireworks AI was breached twice, by two different routes, and its own security bulletins set out the sequence.
- 6 October 2026: Fireworks identified a security incident at 9am PDT and began containment the same day. An unauthorized third party had accessed environment variables used in evaluation jobs in a limited number of customer accounts, capturing API keys and tokens stored as secrets.
- 9 October 2026: Fireworks published its first bulletin and notified Uber.
- 13 October 2026: Uber’s own investigation confirmed that data had been accessed.
- 23 October 2026: A third-party cloud provider hosting Fireworks research and development machines had a security incident of its own.
- 24 October 2026: The attacker used that opening to reach Fireworks development machines. Fireworks says that on 24 October “the unauthorized third party used it to reach Fireworks development machines and then run an unauthorized workload”, which caused further customer data impact. Fireworks detected it the same day.
- 9 November 2026: Fireworks published an update widening the disclosed scope.
- 10 November 2026: Uber began notifying drivers.
- 13 November 2026: Uber publicly confirmed the vendor breach as state filings surfaced.
Fireworks attributes the activity to a financially motivated cybercriminal group whose aim is to sell access tokens taken from large language models to illicit routing gateways. The industry term is LLMjacking: stolen credentials are used to run someone else’s AI model, and the legitimate account holder is left with the bill. Google’s Threat Intelligence Group and Mandiant published research on the technique on 2 November 2026.
Who Else Was Caught in the Same Breach
Uber is not the only Fireworks customer affected, which is what makes this a vendor-chain incident rather than a single company’s problem.
Notion, the workplace software company, said AI chat transcripts used by its Insights feature were exposed in fewer than 1% of workspaces, and that most could not be attributed to a specific user or workspace. Cursor, the AI coding tool, traced an attack on its own extension marketplace to a Cursor-issued access key exposed at Fireworks; it said fewer than 0.05% of users had coding-agent traces exposed and under 0.01% had API credentials exposed. Uber’s exposure sits alongside its wider reliance on AI vendors, including the ChatGPT Work rollout to more than 30,000 staff in October 2026.
Fireworks says payment card numbers are not stored by the company and were not affected. It has disabled self-serve dataset uploads and downloads used by batch inference and dataset-based training while the investigation continues, and is working with Palo Alto Networks’ Unit 42.
What Is Still Unexplained
The central question has not been answered by either company: nobody has said which of the two October intrusions took the driver records.
The gap is visible in the documents. Fireworks’ first bulletin said it had not detected evidence of unauthorized access to customer models, datasets, training data, personal information or inference traffic “within the Fireworks security perimeter or control”. Its 9 November update lists the categories later found to be affected: resource metadata, billing information including billing and shipping addresses and payment history, and, for certain customers, a subset of incomplete model weights and datasets. Driver’s license numbers appear on neither list. Uber, meanwhile, has told state regulators that driver’s license information was taken.
Uber’s public statement describes “a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data” and refers detailed questions to Fireworks. Fireworks has confirmed unauthorized access affecting customer data but has not addressed the Uber records specifically, and its bulletins do not name Uber.
As of 15 November 2026, Uber has published no national total, the Illinois and California counts are not public, no group has claimed the theft, and neither company has explained how the attackers obtained the internal credentials in the first place. Uber says it has cut its data connections with Fireworks. Separately, a hacking group claimed in August 2026 to have taken close to a million files from Uber Freight; Uber Freight confirmed unauthorized access to some systems but did not verify that figure, according to Gizmodo.
Frequently Asked Questions
Am I Affected by the Uber Data Breach?
Uber is notifying affected drivers individually by letter and has not published a list or a national total. At least 7,870 drivers in three states are covered by filings so far, with more states pending.
What Should I Do if I Received an Uber Breach Letter?
Enroll in the free credit monitoring within 90 days of the letter’s date, using the activation code printed on it. Uber also recommends reviewing account statements and credit reports for unusual activity.
Was My Password or Card Number Stolen?
Fireworks AI says it does not store payment card numbers and that they were not affected. Uber’s notices describe personal information including driver’s license information; neither company has said passwords were taken.
Were Uber Riders Affected Too?
Uber’s notifications concern drivers. The company has not said that rider data was involved, and has not published a breakdown of what other Uber data Fireworks could reach.
What Is LLMjacking?
LLMjacking is the theft of credentials for an artificial intelligence service so the access can be resold. The criminal group runs queries through the victim’s account, and the account holder is billed for the usage.
