Uber Reports Third-Party Vendor Breach Exposing Driver Data
Compromised Fireworks AI credentials allowed an unauthorized party to access personal records, prompting Uber to sever connections and offer monitoring.
- By Jesse Jacobs
- Nov 13, 2026
Uber Technologies Inc. disclosed a data security incident after an unauthorized third party compromised the internal credentials of a service provider and accessed Uber's account.
Regulatory filings state that the third-party provider notified the ride-hailing company of the credential compromise on Oct. 9. Uber immediately severed its data connections with the vendor and launched an internal investigation. By Oct. 13, investigators determined that the unauthorized party had accessed Uber data stored with the provider, including personal information.
A Reuters report citing a TechCrunch investigation identified the unnamed service provider as Fireworks AI and noted that the compromised records included U.S. driver's license information. Reuters added that the breach notice was posted on the California attorney general's website without naming the vendor or listing the specific data exposed, and neither Uber nor Fireworks AI immediately responded to requests for comment.
The incident affected approximately 1,873 residents in Rhode Island, alongside residents in California, the District of Columbia, Maryland, New York, North Carolina and Pennsylvania.
Uber stated that its investigation has not identified any misuse of the exposed data. The company is providing affected individuals with complimentary credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Recipients have 90 days from the notice to enroll and are advised to monitor their account statements and consider placing fraud alerts or security freezes with major credit bureaus.