Uber has confirmed that hackers stole driver’s license images and personal details belonging to thousands of its drivers, making the ride-hailing giant the biggest name so far to surface in the fallout from the Fireworks AI breach.
In breach notices filed with U.S. state attorneys general on November 10, Uber said a service provider’s compromised credentials were used to reach Uber data stored for that provider’s work. An Uber spokesperson later identified the vendor as Fireworks AI, the San Mateo company that hosts and fine-tunes open AI models for businesses.
Valid credentials, no alerts
The most striking detail sits in Uber’s letter to the Iowa Attorney General. The stolen data lived in a cloud storage environment Uber built specifically for the vendor. That environment fell under Uber’s cloud security management processes, was overseen by its Cloud Security team and had alerting turned on.
None of it fired. According to the filing, the intruder used valid credentials and data flows that already existed between the 2 companies, so no alerts were triggered. Uber says the compromised credentials did not open any other Uber systems.
That is the core risk of vendor access in plain terms. Once an attacker holds a trusted partner’s keys, their activity can look exactly like normal business traffic.
What drivers lost
Uber’s investigation found the exposed records included:
- Images of driver’s licenses
- Text extracted from those licenses, including name, address and date of birth
- Driver’s license numbers
The company says it has not identified any misuse of the data so far. Affected drivers are being offered free credit monitoring and fraud assistance through Cyberscout, a TransUnion company, with 90 days from the date of the letter to enroll.
Nearly 12,000 drivers across 5 states, and counting
Uber has not released a total. State filings made public so far add up to 11,940 people:
- South Carolina: 3,430
- Iowa: 2,999
- Massachusetts: 2,567
- Rhode Island: 1,873
- Vermont: 1,071
Uber also notified California, where the count was not disclosed, and an Illinois filing lists the number of affected residents as pending. The notice letters carry instructions for residents of New York, Maryland, North Carolina, Pennsylvania and Washington, D.C., which suggests drivers there were affected too. The total is expected to grow as more filings are published.
A 4-day timeline
The dates line up closely with Fireworks’ own disclosures:
- October 6: Fireworks spotted unauthorized use of internal Fireworks credentials
- October 7: The intruder used those credentials to access Uber data, per Uber’s filing
- October 9: Fireworks notified Uber and published its first security bulletin. Uber cut its data connections with the vendor the same day
- October 13: Uber’s investigation confirmed personal information had been accessed
- November 10: Notification letters began going out to drivers
Uber says it has since deleted or rotated all credentials tied to the provider, and Fireworks told Uber it revoked the compromised credentials. Uber’s investigation remains ongoing.
Fireworks’ victim list keeps growing
Fireworks’ first bulletin on October 9 said it had found no evidence of access to personal information. Its November 9 update widened the impact to account and billing data and, for some customers, stored secrets, datasets and incomplete model weights. Notion has already confirmed that Notion AI chat transcripts tied to its Insights feature were exposed in the same incident.
A Fireworks spokesperson confirmed to reporters that the company identified unauthorized access to some of its systems that affected customer data, but did not answer further questions. Uber referred questions about the root cause to Fireworks.
Fireworks has attributed the intrusion to a financially motivated cybercriminal group focused on selling stolen access to large language models, a practice known as LLMJacking. No group has publicly claimed the attack. Fireworks also sits at the top of the wave of attacks on AI developer platforms during October, which BreachNews tracked alongside the Northflank breach and Railway’s decrypted customer secrets.
Uber’s second breach disclosure of 2026
This is Uber’s second known security incident this year. In August, its logistics unit Uber Freight confirmed unauthorized access to part of its systems and repositories after the Helix extortion group claimed it stole nearly 1 million files. Uber Freight said that incident was contained and did not affect operations.
What affected drivers should do
Driver’s license images paired with dates of birth and home addresses are useful for identity fraud, fake account openings and convincing phishing. Drivers who receive a letter should enroll in the offered monitoring, consider a credit freeze and treat unexpected messages about their Uber account, license or payments with suspicion. Anyone unsure whether a notice is genuine can follow our guide on how to tell if a breach notification letter is real.
