Uber Driver Data Breach: 7,870 Licenses Exposed via AI Vendor

Uber confirmed this week that hackers stole the driver's license numbers and personal information of thousands of its drivers in an October breach that occurred at a third-party AI vendor, not inside Uber's own systems. In breach notifications it filed with several state attorneys general this week, including California, the company said an unnamed provider told it on October 9 that intruders had broken in and stolen internal credentials that were used to reach Uber data.

TechCrunch reported that the provider is Fireworks AI, a company whose platform lets developers call open AI models. Fireworks told TechCrunch it identified unauthorized access to some of its systems that affected customer data. That confirms the thread that runs through the puzzle: Uber's drivers were hit not because its own security failed, but because a vendor holding a slice of Uber data was breached. An Uber spokesperson told TechCrunch, "The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data."

Related reading: Vanguard faces class actions over data breach.

The confirmed numbers come from the state filings Uber made this week. In Massachusetts the stolen data included the license numbers of 2,567 individuals. In South Carolina the filing put the figure at 3,430 people, and in Rhode Island at 1,873 residents. A notice in Illinois said some residents had their license information stolen but that the number of affected people was pending. Uber also notified drivers in California, its home regulatory market, but did not say how many there had data stolen. Uber has not said how many drivers it is notifying overall.

Fireworks, in its own disclosure last month, said the loss came from a financially motivated cybercriminal group whose apparent goal was to sell stolen tokens for accessing large language models. No known criminal group has claimed credit for the theft. Fireworks also said the October incident took customer information including billing data and some private AI datasets, and Notion confirmed that its data was also taken in the same Fireworks hack. So the vendor, not just Uber, carries exposure across its customer base.

Related reading: Maersk data breach: WhiteArmor demands $5 million after legacy system hack.

Who pays starts with the driver, where the license number is a durable identifier and the stolen personal data attached to it has fraud value that does not decay quickly. Uber will carry the notification and monitoring costs, and while the reported figures are small next to its scale, the exposure is the shape of a class action and of state attorney general attention on top of the notices it filed. The terms most relevant to shareholders sit in the vendor contract Uber has with Fireworks: whether the agreement indemnifies Uber or requires Fireworks to shoulder the response costs determines how much of the bill lands on Uber's income statement.

On regulation and the contract-driver question, the breach touches a sensitive seam in Uber's model. Drivers are contractors, not employees, which has kept a body of employment costs off the books, but their personal data still flows to Uber as a condition of work, and a vendor-side loss of it tests whether that classification limits the company's duties. A judge and a regulator may answer differently than the employment classification alone would suggest.

Related reading: Why did mortgage rates fall to 7.11%? The drivers behind the fresh low.

This is Uber's second known data breach of the year. Earlier in 2026 the company reported a security incident at its Uber Freight truck-shipping unit for which an extortion gang took credit. Two incidents in one year, one now tied to a third-party vendor, is the kind of pattern that raises procurement and oversight questions in an investor's mind, and it anchors the second-order story: how much of Uber's growing AI workload runs on outside platforms that sit outside the perimeter the company directly controls.

Markets have no confirmed price reaction to report at this writing, and Uber has not quantified a cost from the incident in a filing. The next dated catalysts are concrete: more state breach notifications and their counts as they are disclosed, Uber's response to any state attorney general follow-up, and any litigation a lawyer for affected drivers files. Each will put a firmer number on an incident that is, so far, a costly notification obligation and a test of how the market prices a breach that happened outside the perimeter Uber runs.

Related reading: US data center power demand: EIA sees a record 4,390 BkWh in 2026.

This content is for informational purposes only and does not constitute financial advice. Past performance is not indicative of future results. Consult a qualified financial advisor before making investment decisions.