Uber discloses driver data breach after AI vendor Fireworks AI was compromised (2026)

On 13 November 2026, Uber — the San Francisco-based ride-hailing and delivery company — began notifying thousands of drivers that their personal and driver's-license information had been stolen in a breach at one of its technology providers. Uber said it was informed on 9 October 2026 that attackers had broken into the vendor and used stolen internal credentials to reach data the provider held on Uber's behalf. The company characterised the event as "a security incident impacting one of our third-party vendors" and deferred further questions to that provider.

The third-party vendor

The provider was Fireworks AI, a platform that gives developers access to open-source AI models and that had access to some Uber data. Fireworks confirmed a security issue involving unauthorised access that affected customer data, which it attributed to a financially motivated group seeking to resell stolen tokens used to access large language models. The same Fireworks compromise — part of a wider wave of attacks on AI developer platforms in October 2026 — also exposed data belonging to other Fireworks customers, including Notion, whose AI chat transcripts were accessed.

What was exposed

Uber said the stolen data included drivers' personal information and driver's-license details. The company has not given a company-wide total, but state breach filings offer a partial picture: roughly 2,567 individuals in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island, with additional filings in Illinois and California and the overall figure expected to rise as more notices are submitted.

Why it matters

The incident is the second data breach disclosed by Uber in 2026, following a summer extortion claim against its Uber Freight unit. More broadly, it illustrates how a single compromised AI vendor can cascade into exposures across many of its downstream enterprise customers at once. For affected drivers, stolen driver's-license numbers raise a lasting risk of identity theft and targeted fraud, so they should watch for suspicious account activity and phishing that references their Uber relationship.