Uber vendor breach exposed thousands of drivers’ licence information

Uber says a breach at third-party provider Fireworks AI exposed thousands of drivers’ licence records, although the company has not published a single total for everyone affected.

A California Department of Justice breach-notification filing identifies Uber Technologies, Inc. and dates the underlying incident to 7 October 2026. The filing confirms the affected organisation and breach date; separate reporting recorded in the Corpus says Uber later told drivers that information held by Fireworks AI had been accessed after attackers stole internal credentials.

The numbers currently available are spread across state notifications. The reported figures include 2,567 Massachusetts residents, 3,430 people in South Carolina and 1,873 Rhode Island residents. California and Illinois notifications have also been filed, but the records available so far do not provide a final combined count. That means the headline description — thousands of drivers — is supported, while a precise nationwide total would be guesswork.

The exposed information included drivers’ licence details. There is no verified indication in the available records that the licences were misused, and the full technical route used by the attackers has not been established. Those gaps matter: a breach notification confirms that personal information was involved, but it does not automatically prove identity theft or explain every step of an intrusion.

The incident also highlights the risk created by vendors that handle sensitive information on a company’s behalf. The Corpus record says Fireworks attributed its incident to a financially motivated cybercriminal group seeking tokens used to access large language models. That description points to a broader security problem around credentials and third-party access, rather than evidence that Uber’s own customer systems were directly compromised.

Uber has not provided a final total covering every state, and Fireworks did not answer the independent questions recorded in the source trail. Until further notifications or company statements fill those gaps, the responsible reading is that the affected-driver count remains incomplete.

Our opinion

The important detail here is not the most dramatic possible interpretation; it is the uncertainty. Drivers need to know whether their documents were involved, what information was exposed and what practical protection is available. A rolling set of state filings is useful evidence, but it is not a finished incident report. Uber and Fireworks should publish a clear account of the affected records and the safeguards now in place, rather than leaving drivers to assemble the answer from regulatory paperwork.