The envelope looked ordinary. A plain white letter, the kind most of us toss aside without a second thought. But for thousands of Uber drivers across the United States, the letter inside carried the first news of the Uber data breach: their driver’s license details had been stolen, and the thieves had not broken into Uber at all.
Uber confirmed the breach on November 13, after TechCrunch reviewed the notices the company had mailed to drivers. The letters, dated November 10, say an unauthorized party used compromised credentials at one of Uber’s outside vendors to reach personal information stored with that vendor. The vendor, Uber later confirmed to TechCrunch, was Fireworks AI, according to Cyber Security News.
What happened in the Uber data breach
According to the notice Uber filed with California’s attorney general, the incident began on Wednesday, October 7, 2026. That is the date the breach is officially listed as having happened, though Uber says it learned about it two days later.
On October 9, Fireworks AI told Uber that an unauthorized party had compromised its internal login credentials. Those credentials opened a door into Uber’s account with the provider, and through it, into personal records that Uber had stored outside its own systems.
Uber says it immediately cut its data connections with the provider and opened an investigation. By October 13, investigators had confirmed the worst: the attacker had used the stolen credentials to access Uber data, including personal information belonging to the people now receiving letters.
The letters themselves do not name the vendor. Drivers reading them see only the words “a service provider.” It was an Uber spokesperson who confirmed to TechCrunch that the company in question was Fireworks AI, an artificial intelligence infrastructure firm that runs open AI models for developers.
How many drivers are affected
So far, the known numbers come from state filings, and they add up to at least 7,870 people. South Carolina lists 3,430 affected residents, Massachusetts 2,567, and Rhode Island about 1,873. Illinois has filed too, but its count is listed as pending, and California’s notice gives no total at all.
That means the real number is almost certainly higher. Uber has not disclosed a nationwide total, and more notices are expected to surface as filings continue. For now, every confirmed case involves drivers. Nothing in the evidence so far suggests that riders who have never driven for Uber were affected.
What exactly was taken is less clear. The California notice leaves the data-elements field blank — literally printed as the merge field “<<data elements>>” — so the posted document never says what was stolen. But state filings reviewed by TechCrunch identified driver’s license information among the exposed records.
The Fireworks AI connection: a breach that keeps spreading
Uber is not the only company caught in the Fireworks AI fallout. As wasl.tech reported earlier this month, Fireworks AI itself disclosed in October that attackers had reached customer datasets, secrets and even incomplete model weights in a widening breach.
That incident, which Fireworks said involved a second intrusion in late October through a third-party cloud host, was already one of the biggest AI infrastructure breaches of the year. The Uber disclosure shows the damage reaching further than first thought, into the records of a company that had simply stored some of its data with the vendor.
Notion, the productivity app, disclosed on November 12 that AI chat transcripts belonging to under one percent of its workspaces were also exposed through the same provider. It said its own systems were not breached, and it revoked API keys that users had typed into prompts on November 11.
The pattern is becoming familiar. One provider’s security failure, and the blast radius spreads to every customer that trusted it with sensitive data. A similar chain ran through the Railway breach earlier this month, where stolen AI keys racked up $740,000 in fraudulent charges.
The Fireworks case is not the only time this autumn that an AI platform’s sharing features exposed other people’s data. Earlier this month, researchers found tens of thousands of apps built with xAI’s Grok Build leaking private information through shareable links — a reminder that the new AI tools can fail in ways their users never expected.
Fireworks confirmed to TechCrunch that an unauthorized party had accessed part of its systems and breached customer data. The company has linked the attack to criminals seeking to sell stolen access tokens for large language models, though the full picture of who was behind it remains unclear.
What Uber is offering affected drivers
Uber says it has not identified any misuse of the exposed information as of the date of the letter. That is reassuring, but a driver’s license number is the kind of detail that can be used quietly, months later, to open accounts or pass identity checks. The risk does not expire with the news cycle.
The company is offering free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Affected drivers must enroll within 90 days of their letter’s date, using the activation code printed in it. Uber has also set up a dedicated phone line for questions.
Drivers who receive a letter should read it closely, check their account statements, and consider placing a fraud alert or a credit freeze. A freeze limits access to credit reports, making it harder for someone to open new accounts in their name, according to the Federal Trade Commission.
Why this breach raises bigger questions
The most awkward question for Uber remains unanswered: why was driver’s license information sitting with an AI vendor at all? Uber has not explained what work it used Fireworks AI for, or why the vendor needed access to that kind of personal data. The letters offer no answer either.
That silence matters, because the breach was not a sophisticated break-in at Uber itself. It was a credential compromise at a supplier, the kind of supply-chain weakness that has defined so many of this year’s biggest incidents. A single set of stolen logins became a key to thousands of people’s records.
It is also, according to reports, the second known breach to hit Uber in 2026. For a company that moves millions of people and stores the identity documents of its drivers, the pattern is hard to ignore, and regulators in several states are now watching the filings closely.
What drivers should do now
If you drive for Uber, watch for the letter. It is dated November 10 and comes with an activation code for the free credit monitoring. Enroll before the 90-day window closes, even if nothing looks wrong yet — the point of monitoring is to catch misuse early, not after the damage is done.
Check your credit reports, set up a fraud alert or a freeze, and keep an eye on any account that asks for your license details. And if you have never driven for Uber, the current evidence gives no reason to worry — but it is a reminder that your data often travels further than you think.
The Fireworks AI breach started as an AI industry story. With Uber’s confirmation, it has become a story about thousands of ordinary drivers, learning from a letter that their identity documents were stolen through a company they had never heard of. The next question is how many more companies will find their names on the same list.
