Hackers used credentials stolen from Uber’s AI vendor Fireworks AI to reach images of Uber drivers’ licenses — and the personal data on them — in an October intrusion. State breach filings made public so far cover about 16,236 people across six states, and Uber has given no national total, so that figure is a floor, not a final count. Why it matters: a license image is a government identity document, and unlike a password, the data on it cannot simply be reset.
November 15, 2026
What happened
Uber has confirmed that the breach notices now going out to drivers relate to a security incident at Fireworks.ai, the AI inference company that runs open models for other businesses and had access to some Uber data. Uber’s most detailed account is a November 10 letter to the Iowa Attorney General. It says a service provider told Uber on October 9 that an unauthorized party had compromised the provider’s internal credentials, and that Uber’s investigation determined on October 13 that the intruder had used those credentials on October 7 to access Uber data.
The files sat in a cloud storage environment Uber says it created specifically to enable the provider’s work. Because the intruder used valid credentials and data flows the provider was already allowed to use, Uber says its alerting — which was switched on — never fired. Uber says it cut its data connections with the provider, deleted or rotated credentials tied to it, and has not identified any misuse of the data to date.
What was taken, and how many drivers are affected
According to the Iowa filing, the data included images of driver’s licenses and text extracted from them: name, address, date of birth and license number. The published state counts are approximately 2,999 people in Iowa, 3,430 in South Carolina, 2,567 in Massachusetts, 1,873 in Rhode Island, 1,071 in Vermont and 4,296 in Texas — about 16,236 in total. California drivers have also been notified without a published count, an Illinois figure is still pending, and more filings may follow. Uber is offering affected drivers free credit monitoring and fraud assistance through Cyberscout, with enrollment required within 90 days of the date on their letter.
One vendor breach, several victims
Uber is the latest confirmed victim of the same Fireworks incident. Fireworks first disclosed a security problem on October 9 and, in an update revised November 9, said it had found impacts to account and billing information and, for a limited set of accounts, to secrets, datasets and incomplete model weights. It linked the attack to a financially motivated group trying to sell stolen access to large language models. Notion has told customers that some AI chat transcripts were exposed through the same provider, and Cursor has said a stolen Fireworks-exposed key led to a trojanized Claude Code extension — separate victims, separate data, one set of stolen vendor credentials underneath.
Why it matters
The practical lesson is uncomfortable and simple: data handed to an AI vendor for processing is only as safe as that vendor’s credentials. Uber’s own account says its monitoring worked as designed and still saw nothing, because the intruder looked exactly like the trusted vendor. For drivers, the takeaway is concrete — if you get a letter, enroll in the monitoring and watch for accounts opened in your name. For every company now piping documents and ID images into AI services, the question worth asking is which vendors hold standing access to that data, and what those credentials can reach if they are stolen. That is the “everything AI, tested” reality check here: the AI supply chain is now part of your security perimeter, whether you planned it that way or not.
Frequently asked questions
What data was stolen in the Uber breach?
Images of driver’s licenses and the text extracted from them — name, address, date of birth and license number — according to Uber’s filing with the Iowa Attorney General.
How many Uber drivers are affected?
State filings made public so far cover about 16,236 people across six states. Uber has not given a national total, and more state filings are expected, so the real number is likely higher.
How did the attackers get in?
They used internal credentials stolen from Uber’s AI vendor, Fireworks AI, to access a cloud storage environment Uber had set up for the vendor’s work. Uber was notified on October 9 and confirmed the access on October 13; the access itself happened on October 7.
What should affected drivers do?
Enroll in the free credit monitoring and fraud assistance offered in the notice letter (within 90 days of the letter’s date), watch account statements, and consider a fraud alert or credit freeze.
Sources: TechCrunch, PCMag, Uber’s November 10, 2026 notification filing with the Iowa Attorney General, Fireworks AI’s October 2026 security incident update.