Uber Confirms Data Breach Exposing Personal Information of Nearly 7,900 US Drivers

Ride-hailing company Uber has confirmed that the personal information of thousands of its US drivers was exposed in a data breach involving its third-party tech

Ride-hailing company Uber has confirmed that the personal information of thousands of its US drivers was exposed in a data breach involving its third-party technology service provider, Fireworks AI.

The exposed information reportedly includes sensitive details from drivers' licences. Although Uber has begun notifying affected individuals, it has not disclosed the total number of people affected across the country.

Uber was first alerted to the incident on October 9, 2026, when the service provider informed the company that its internal login credentials had been compromised. The attackers used those credentials to access Uber's data, exposing personal information stored outside Uber's internal systems.

Upon learning of the incident, Uber immediately severed its data connections with the provider and launched an investigation. On October 13, investigators confirmed that the attackers had accessed Uber's data, including the personal information of individuals who are now being notified. Uber issued formal notifications regarding the breach on November 10, 2026.

According to breach notifications filed in different US states, 2,567 people in Massachusetts, 3,430 in South Carolina and approximately 1,873 in Rhode Island were affected. This brings the confirmed number of affected individuals in the three states to 7,870. However, the actual number is likely higher, as notifications have also been sent to residents of other states.

Meanwhile, Uber's public notice filed in California did not specify the types of information compromised. However, documents from other states reviewed by technology news outlet TechCrunch confirmed that the exposed records included driver's licence information. The available documents specifically concern Uber drivers, so it remains unclear whether passengers or other Uber account holders were also affected.

Speaking to TechCrunch, an Uber spokesperson confirmed that Fireworks AI was the third-party service provider involved in the incident.

Earlier, Cyber Security News had reported a major data breach involving Fireworks AI, in which customer information and certain datasets were reportedly exposed. However, those reports did not clearly establish which additional information was connected to Uber.

Fireworks AI was also handling data involved in a separate chat transcript breach affecting Notion AI. Notion stated that its internal systems remained secure and that less than one percent of its customers' workspaces were affected.

These incidents highlight how security vulnerabilities at third-party service providers can expose sensitive information belonging to multiple companies and their customers.

According to Uber's official notification, the company has found no evidence of misuse of the compromised information as of the date of the notice. It is offering affected drivers free credit monitoring and fraud assistance through CyberScout, a subsidiary of TransUnion.

Affected individuals must register for the service using the activation code provided in their notification letter within 90 days of the date stated in the letter.

Uber has advised affected drivers to carefully review their notification letters, regularly monitor their bank accounts and immediately report any suspicious transactions.

The company has also recommended that drivers consider placing a fraud alert or credit freeze on their credit reports. According to the US Federal Trade Commission (FTC), a credit freeze restricts access to a person's credit report, making it more difficult for criminals to open fraudulent accounts using their identity.