Uber is notifying U.S. drivers after an unauthorized party used compromised credentials at a third-party provider to access Uber data containing personal information.
The California attorney general’s breach notice lists October 7, 2026, as the incident date and November 10 as the report date, but does not name the provider or identify the data fields.
The provider notified Uber on October 9 that its internal credentials had been compromised. Uber severed its data connections with the provider and opened an investigation. By October 13, the investigation had confirmed that the credentials were used to access Uber data, according to the California notice and Reuters’ reporting on the filing. Uber said it had not identified any misuse and is offering free credit monitoring and fraud assistance through Cyberscout; recipients have 90 days from the date of their letter to enroll.
TechCrunch reviewed notices filed in Massachusetts, South Carolina and Rhode Island and reported that they list 2,567, 3,430 and 1,873 people, respectively. The combined figure is at least 7,870. TechCrunch also found that an Illinois filing listed the affected count as pending, while the California notice did not provide a total; the outlet said the number is expected to rise as more notices are filed. Uber has not disclosed a nationwide figure.
TechCrunch identified the provider as Fireworks AI, and an Uber spokesperson confirmed that the notices concerned a security incident involving Fireworks.ai, which had access to some Uber data. The outlet reported that the accessed information included drivers’ license details. Fireworks separately confirmed unauthorized access to some of its systems but did not address the Uber-specific questions. The vendor had also disclosed an earlier security incident affecting customer data, including Notion AI chat transcripts, described in Abijita’s Fireworks AI breach report and its coverage of Notion’s AI chat exposure.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
