Uber Driver License Data Compromised in Third-Party AI Provider Breach

Image: TechCrunch · Source

Hackers stole thousands of Uber drivers' licenses from Fireworks AI, an AI cloud vendor, in an October data breach, Uber confirms. The incident affected drivers in multiple U.S. states, with notifications underway.

Uber has disclosed that personal information, including driver's license data of thousands of its drivers, was stolen in a data breach involving one of its third-party technology providers, Fireworks AI, a company specializing in AI cloud services. The breach, which occurred in October 2026, was reported to Uber on October 9, after hackers gained access by compromising internal credentials from Fireworks AI.

Fireworks AI offers developers access to open AI models and had its customer data exposed, including billing information and private AI datasets. Uber learned that the stolen data included Uber drivers' personal information that Fireworks AI had stored. Upon notification, Uber began alerting affected drivers about the security incident.

According to data breach filings reviewed by TechCrunch, thousands of drivers in various states were impacted: 2,567 in Massachusetts, 3,430 in South Carolina, and 1,873 in Rhode Island had their driver's license details stolen. Illinois and California drivers were also notified though exact numbers were not provided. The overall count of affected individuals is expected to increase as more notifications are made.

Fireworks AI attributed the breach to a financially motivated cybercriminal group aiming to sell stolen access tokens for large language models. No hacking group has publicly claimed responsibility for this data theft.

This incident marks Uber’s second known data breach in 2026. Earlier in the year, Uber Freight, the company’s truck shipping unit, experienced a security breach exploited by an extortion gang. Uber deferred detailed questions about this latest incident to Fireworks AI, which has not publicly responded.

The breach highlights risks stemming from third-party vendors in the technology supply chain, notably those connected to AI infrastructure services, where sensitive personal data can be exposed through compromised access credentials. Uber continues to work with affected drivers and authorities as investigations proceed.