Uber says third-party service provider data breach led to theft of U.S. drivers’ license information
In a notice submitted to the California Attorney General, Uber said an unauthorized third party used internal credentials that had been compromised at one of its service providers to access data Uber stored with that provider. The provider notified Uber on October 9, 2026 that the credentials had been compromised, and Uber immediately cut off the data connection and launched an investigation. On October 13, the investigation confirmed that the related personal information had been accessed.
TechCrunch reported that the service provider was Fireworks AI, and the data accessed included U.S. drivers’ license information. According to state filings, 3,430 people in South Carolina, 2,567 in Massachusetts, and 1,873 in Rhode Island were affected; California, Illinois and other states have also notified some drivers, but the national total has not yet been disclosed. Uber said it has not found any evidence that the data has been misused and is offering affected individuals free credit monitoring and fraud assistance services through Cyberscout, a TransUnion subsidiary.
This incident stemmed from compromised credentials at a third-party service provider, rather than a direct intrusion into Uber’s own systems. Fireworks AI attributed the attack to a criminal group that sells access tokens for large language models. Uber has begun sending notices to affected drivers.
Original source:
Title: Uber says US drivers' license data stolen in data breach
Publisher: Reuters
Publication date: 2026-11-13
URL: reuters.com/business/uber-says-us-drivers-license-data-stolen-data-breach-2026-11-13
Source type: News report (citing a notice on the California Attorney General’s website)
Verification status: This time we actually read the Reuters report and cross-checked the state filing numbers reported by TechCrunch; verification date 2026-11-13
Supporting content: Third-party credentials were used to access Uber data, the timeline of the October 9 notice and October 13 confirmation, the theft of driver’s license information, and the numbers in some states
ABAB AI Insight
The breach path clearly points to the third-party AI service provider Fireworks AI, rather than Uber’s direct systems. The attacker used stolen credentials to access Uber’s driver data stored by the provider, highlighting supply-chain security risks: when companies hand sensitive identity information such as driver’s licenses to external AI platforms, credential management becomes a single point of failure. The numbers disclosed by states already total more than 7,800 people, and California, New York and other places have not yet provided complete figures, so the actual scope may continue to expand.
Uber’s notice cut off the connection, launched an investigation and offered credit monitoring, in contrast to its history in 2016, when it concealed a large-scale breach involving about 600,000 U.S. driver’s license numbers and paid a ransom. This time the disclosure was faster, but the data has already been confirmed as accessed. Things to watch are whether there are later reports of misuse, whether other customers disclose that they were affected, and whether Fireworks AI provides further detail on the scope of customer data exposure.
Against the backdrop of ride-hailing drivers needing to submit government identity documents to complete background checks, the leak of driver’s license information increases the risk of identity theft and fraud. Uber stressed that it has found no misuse, but the monitoring service requires affected individuals to enroll on their own. Future regulatory attention may focus on the data retention scope and access-control requirements of third-party AI service providers.
ABAB News · Laws of cognition
A credential leak at a third-party AI service provider can lead to the access of customer identity documents such as driver’s licenses.
State filings can gradually reveal the number of affected people, and the national total may not be disclosed at the same time.
Cutting off connections and providing monitoring can be done at the same time after it is confirmed that data has been accessed.