Thousands of Uber drivers across the United States are currently grappling with the fallout of a significant data security incident that has exposed their personal information, including sensitive driver’s license data. The breach, which originated at a third-party technology vendor used by the ride-hailing giant, highlights the growing vulnerabilities associated with modern corporate supply chains and the increasing frequency of cyberattacks targeting AI-focused infrastructure.
Uber officially confirmed the breach in filings submitted this week to various state attorneys general, including those in California, Massachusetts, South Carolina, and Rhode Island. According to the company, the incident was first brought to its attention on October 9, when a technology provider—subsequently identified as Fireworks AI—notified Uber that unauthorized actors had successfully bypassed security protocols. The hackers reportedly compromised internal credentials belonging to the provider, which were then leveraged to gain illicit access to Uber’s own data stored within the vendor’s environment.
The revelation has prompted a wave of mandatory notifications from Uber to affected drivers. The company has moved to inform those whose personal information was housed with the vendor, though the precise scale of the breach remains a moving target. As of now, Uber has declined to provide a comprehensive count of the total number of customers or drivers affected, leaving many in the dark regarding the full extent of the exposure.
Fireworks AI, a company that provides infrastructure for developers to access and utilize open-source AI models, appears to be the nexus of the incident. Last month, Fireworks confirmed that it had been the victim of a sophisticated cyberattack. In that incident, hackers successfully infiltrated the company’s systems to exfiltrate customer information, including billing records and private AI datasets. Uber is not the only high-profile company affected by this lapse in security; the online productivity startup Notion has also confirmed that its own data was compromised in the same Fireworks AI breach, underscoring the broad reach of the incident.
When pressed for comment, an Uber spokesperson confirmed that the notices being sent to drivers are directly related to the security incident at Fireworks.ai, noting that the vendor had been granted access to specific segments of Uber’s data for operational purposes. Beyond this confirmation, Uber has largely deferred further inquiries to Fireworks. Efforts to reach representatives at Fireworks for comment on the specifics of the breach, the nature of the vulnerability, or the total number of impacted parties have so far gone unanswered.
The impact, while still being quantified, is clearly significant. Data breach notices filed across multiple jurisdictions offer a glimpse into the geographic spread of the stolen information. In Massachusetts alone, the breach affected 2,567 individuals whose driver’s licenses were compromised. South Carolina saw an even larger impact, with 3,430 residents reporting their license information stolen. In Rhode Island, 1,873 individuals were affected. Filings in Illinois indicate that some residents of that state also had their driver’s licenses exposed, though the total number of victims there remains under review. While Uber has also begun notifying drivers in California, the company has not yet disclosed the specific number of impacted residents in the state. Industry experts expect these figures to climb steadily as further breach reports are filed and the scope of the exposure is more accurately audited.
The nature of the breach suggests a calculated motive. Fireworks AI has attributed the attack to a financially motivated cybercriminal group. Rather than engaging in traditional data theft for the purpose of identity fraud alone, the attackers appear to have been targeting the technical infrastructure of the company. Specifically, the group’s primary goal was to steal authentication tokens that grant access to large language models (LLMs). These tokens are highly valuable in the current market, as they allow unauthorized users to utilize expensive, high-powered AI computing resources at the expense of the legitimate account holder. To date, no specific cybercriminal syndicate has stepped forward to claim responsibility for the attack, leaving investigators to parse through digital footprints without a clear perpetrator.
This incident marks the second time this year that Uber has had to contend with a significant security breach. Earlier in 2026, the company reported a separate security incident involving its Uber Freight division, the company’s logistics and truck shipping arm. In that instance, an extortion gang claimed responsibility for the theft of sensitive data, highlighting a persistent challenge for the ride-hailing giant as it attempts to secure a vast, interconnected network of third-party vendors and internal business units.
The situation serves as a stark reminder of the "vendor risk" problem that continues to plague large-scale technology companies. As Uber and other major corporations increasingly rely on specialized providers like Fireworks AI to facilitate everything from cloud storage to AI model deployment, their security posture becomes inherently tied to the defensive capabilities of those smaller, often less-resourced partners. When a vendor is compromised, the primary company—in this case, Uber—is often left in the position of managing the fallout, handling the legal notifications, and navigating the resulting trust deficit with its user base, even if the failure occurred outside of its own direct infrastructure.
For the affected drivers, the theft of driver’s license information is particularly concerning. Unlike a password, which can be changed, or a credit card number, which can be canceled, a driver’s license is a foundational identity document. Once compromised, such information can potentially be used in complex identity theft schemes, fraud, or even to create fraudulent documentation. While Uber is currently in the process of notifying these individuals, the lingering question for many is how such high-value information was allowed to be accessible to a third-party vendor in the first place, and what security protocols will be implemented to prevent a recurrence.
As the situation unfolds, state regulators and cybersecurity experts will likely keep a close eye on the filings. The increasing reliance on AI-focused vendors introduces a new class of digital assets—such as LLM access tokens—that are clearly becoming prime targets for international cybercriminal groups. For now, thousands of drivers are left waiting for further guidance from the company, while the broader tech industry faces renewed scrutiny over the risks of integrating third-party AI providers into core business workflows. With the total number of victims expected to rise in the coming weeks, the incident at Fireworks AI remains a developing story that underscores the ongoing, high-stakes battle between corporate data security and increasingly sophisticated digital threats.
