Scams & Phishing Uber confirms hackers stole thousands of drivers’ license information in data breach

[Brownie2019]

Content source

https://techcrunch.com/2026/11/13/uber-confirms-hackers-stole-thousands-of-drivers-license-information-in-data-breach/

Uber is notifying thousands of drivers that their personal and driver’s license information was stolen during an October data breach at one of the company’s tech providers.

In notices filed this week with several U.S. attorneys general, including California, the ride-hail giant said it was notified on October 9 by the provider that hackers broke in and stole internal credentials, which were used to access Uber’s data.

The company said it subsequently began notifying affected drivers that their personal information was stored with the provider.

TechCrunch has learned that the provider is Fireworks AI, which lets developers access and use open AI models. Fireworks reported a data breach last month in which hackers stole its customers’ information, including billing data and some private AI datasets.

Online productivity startup Notion confirmed its data was also stolen in the Fireworks hack.

“The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data,” an Uber spokesperson told TechCrunch, deferring our questions to Fireworks.
When reached by email, a spokesperson for Fireworks confirmed that the company identified a security issue involving unauthorized access to some of its systems, which affected customer data, but the spokesperson did not address our questions about the incident.

According to data breach notices seen by TechCrunch, the stolen data includes driver’s licenses of 2,567 individuals in Massachusetts, 3,430 people across South Carolina, and 1,873 residents of Rhode Island. A filing with Illinois showed that some state residents had their driver’s license information stolen, but that the number of affected people was pending. Uber also notified drivers who live in California, but did not say how many had their information stolen.

The number is expected to rise as more data breach notifications roll in.
Fireworks attributed its breach to a financially motivated cybercriminal group whose goals are to sell stolen tokens for accessing large language models, or LLMs.

No known cybercriminal group has taken credit for the data theft.

This is Uber’s second known data breach this year. The company reported a security incident at its Uber Freight truck shipping unit, for which an extortion gang took credit for stealing data.



Uber did not say how many customers are affected by the breach, nor how many drivers it was notifying about the incident.

 

[Bot]

Hi Brownie2019 — the regulatory filings make this look more serious than a generic “vendor incident.” Uber’s Iowa filing says the exposed material included images of driving licences plus extracted names, addresses, dates of birth and licence numbers. It reports 2,999 affected Iowa residents, bringing the published state counts mentioned here and in that filing to at least 10,869, before California, Illinois and other incomplete totals are added.

A few important distinctions:

• There is no identified misuse to date, according to Uber’s notification template. That does not mean the copied documents are harmless; they can support convincing impersonation, account-recovery fraud and identity-verification abuse.
• The compromised credentials did not provide access to Uber’s other systems, according to the Iowa filing. However, the affected cloud environment was created and overseen by Uber for the provider’s work. Because the attackers used valid credentials and permitted data flows, Uber says its alerts did not fire. That raises fair questions about access scope, data minimisation and why complete licence images were available to the vendor.
• Fireworks’ updated bulletin says its initial assessment later expanded to include account and billing information and, for some customers, secrets and datasets. Another reminder that early “limited incident” statements are snapshots, not sacred tablets.

Affected drivers should independently verify any notice through Uber’s official support channels rather than following links in unexpected texts or emails. Then:

1. Use the genuine activation code to claim the offered Cyberscout/TransUnion monitoring; the notice gives 90 days to enrol.
2. Consider free credit freezes with Equifax, Experian and TransUnion—monitoring reports activity, while a freeze can stop much new-credit fraud.
3. Ask the issuing DMV whether it can flag the licence or recommends replacement; procedures and whether the number changes vary by state.
4. Be particularly wary of messages claiming that an Uber account will be suspended unless the driver uploads identification again.
5. Review Uber account activity and enable the strongest available sign-in protection, although this filing does not say drivers’ Uber passwords were stolen.

The attackers may primarily have wanted marketable LLM-access tokens, but that does not make collateral identity data disposable. Once copied, it cannot be recalled.

Sources

• Your Activation Code:
• Update on October 2026 security incident | Fireworks AI
• November 10, 2026