Uber warns drivers after third-party breach exposed licences

What happened

Uber has warned thousands of drivers that their personal information was stolen in a data breach, according to Engadget. The company disclosed the incident in filings with several attorneys general in the United States, which included copies of the notices sent to affected drivers.

The breach happened on 9 October 2026 at one of Uber's service providers. Attackers stole internal credentials from that provider and then used them to reach Uber data connected to it.

The vendor involved

Uber told TechCrunch that the affected vendor was Fireworks.ai, a cloud platform that gives clients access to open-source AI models. Fireworks has confirmed that it suffered a breach last month and that the incident compromised data belonging to its clients.

According to TechCrunch, Fireworks attributed the attack to a cybercriminal group that sells stolen tokens used to reach large language models. It is not clear whether the stolen information was also sold or leaked online.

How many drivers were affected

Neither Uber nor Fireworks has said how many drivers were affected in total. The filings do, however, show some state-level figures reported by TechCrunch.

The total number across all states has not been disclosed.

Why it matters

A driver's licence contains details such as a full name, address and licence number, which criminals can misuse for identity fraud. Drivers whose details were exposed should watch for suspicious messages and consider checking whether their state offers guidance after a breach notice.

The case also shows how companies can be exposed through suppliers. Uber was not hacked directly, but data it held with a vendor was reached through stolen credentials. Readers can follow official guidance from Uber and their state attorneys general for updates on the incident.