Uber says AI Vendor Breach exposed US drivers’ license data

Uber has begun reaching out to thousands of drivers across the US about the recent security incident involving one of its third-party AI providers. The breach resulted in potential exposure of the drivers’ personal data, including their license details. The company detailed the incident in notices sent out to drivers on November 10.

How Uber learned its vendor had been breached

The provider reached out to Uber on October 9, 2026, after hackers obtained internal credentials and exploited them to access Uber’s account. Uber said that it cut off the data connection immediately and launched an investigation. By October 13, the company had verified unauthorized access to the drivers’ personal data.

Uber has provided its users with complimentary monitoring and fraud assistance from Cyberscout. So far, no misuse has been reported.

The notice to the drivers about the incident was dated November 10, which means that 28 days have passed since the verification was made. However, the gap between verification and notification of affected drivers does not mean that there is a reporting violation.

The provider is Fireworks AI, TechCrunch reported

The affected provider was Fireworks AI, a company that gives developers access to AI models, according to TechCrunch. Uber also confirmed to the publication that Fireworks held some of its data.

So far, reported figures show 7,870 affected people across three states: 3,430 in South Carolina, 2,567 in Massachusetts and 1,873 in Rhode Island. The South Carolina Department of Consumer Affairs independently confirms its state’s count.

However, the full extent of the breach remains unclear. California and Illinois have not released their figures, meaning the 7,870 total covers only the three states with reported counts. The nationwide number of affected drivers is still unknown.

A credential theft tied to “LLMJacking”

In its November 9 bulletin, Fireworks announced that the breach was more serious than just stolen credentials. Account and billing information were accessed. Certain customers had their secrets, datasets, and unfinished AI models accessed. Fireworks specified that payment card numbers were unaffected.

The company also revealed another breach. On October 23, a provider of cloud services that was hosting the Fireworks systems was victimized. The hackers used access to that cloud service the following day to obtain further customer information. Fireworks reported no additional successful breach after October 25.

Fireworks has connected the attacks with LLMJacking, a scheme based on stolen access to AI models. In a separate case, Google and Mandiant revealed that unauthorized AI use incurred costs of more than $100,000 within just one day. However, these expenses are not associated with Uber.

Why this breach is not the 2016 cover-up

Uber has faced a major data breach before, but its response was different. In 2018, California’s attorney general announced a $148 million settlement over a concealed 2016 breach affecting 57 million people. Investigators said Uber paid hackers $100,000 to remain silent and failed to notify more than 174,000 California drivers.

This time, Uber says it promptly disconnected the affected provider, notified drivers and offered credit monitoring. So far, public disclosures show no evidence of a similar cover-up.

Third-party risk is now the bigger exposure

Uber’s latest breach highlights a growing concern: companies can lose sensitive information through vendors they depend on. The World Economic Forum found that 65% of large companies considered third-party and supply-chain vulnerabilities their biggest cyber-resilience challenge, up from 54% in 2025.

Meanwhile, IBM estimated the global average breach cost at $4.99 million. Verizon examined more than 22,000 confirmed breaches across 145 countries. These figures reflect broader cybersecurity risks, not Uber’s actual losses.

Cryptopolitan previously reported a similar third-party AI-tool compromise involving Vercel. For Uber, three questions remain: How many drivers were affected nationwide? What specific information was exposed? What safeguards controlled Fireworks’ access to Uber data? The company’s public notice leaves these questions unanswered.