TL;DR: The 2026 Uber data breach exposed images of drivers’ licenses plus the text pulled from them (name, address, date of birth and license number). Uber says an attacker used stolen credentials from one of its service providers to get into Uber data on October 7, 2026. Uber names the vendor as Fireworks AI, an AI model hosting company that disclosed its own breach in October. Uber started mailing notices on November 10, 2026, through Cyberscout (a TransUnion company) and is offering free credit monitoring if you enroll within 90 days of your letter’s date. State filings so far count about 16,000 people in six states. A breach tracker reading the Texas Attorney General’s record reports 149,346 people affected in total, but Uber hasn’t confirmed a total. Uber says it has not identified any misuse of the data.
Last updated: November 14, 2026. By Veer. Facts checked against Uber’s breach notice filed with the Iowa Attorney General (November 10, 2026), the sample letter on the California Attorney General’s site, Fireworks AI’s October 10 and November 9 security bulletins, Notion’s Fireworks AI incident advisory, and reporting from TechCrunch, PCMag and Reuters. This is a researched explainer based on public filings and reporting.
What happened in the Uber data breach?
An unauthorized party stole a service provider’s internal credentials and used them on October 7, 2026, to access Uber data stored for that provider’s work. The provider told Uber on October 9, and Uber’s investigation confirmed on October 13 that drivers’ personal information had been accessed. Uber says it “immediately severed data connections with the service provider.”
Uber’s letter to the Iowa Attorney General, sent by its law firm Ashurst Perkins Coie on November 10, adds detail the consumer letter leaves out. The data sat in “a cloud storage environment created by Uber specifically to enable the service provider’s work.” That environment had alerting turned on, but “because the unauthorized third party used valid credentials and data flows enabled by the compromise on the service provider’s system, no alerts were triggered.”
Uber says the vendor’s stolen credentials “did not provide access to other Uber systems.” After the incident, Uber deleted or rotated every credential linked to the provider, and the provider told Uber it had revoked the compromised credentials. Uber’s investigation is still ongoing.
Which vendor was hacked? Fireworks AI
The vendor is Fireworks AI, a platform developers use to run and fine-tune open AI models. Uber’s filings don’t name it, but an Uber spokesperson confirmed it to TechCrunch on November 13: “The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data.”
Fireworks AI has published two bulletins about its incident:
- October 10 bulletin: Fireworks says it identified “unauthorized use of internal Fireworks credentials” on October 6, 2026. At that point it believed only API keys and tokens stored as secrets in evaluation jobs had been taken, and it said it had found no evidence that personal information was accessed.
- November 9 update: Fireworks says it later “discovered impacts to account and billing information,” and for “a limited set of accounts” also “secrets, datasets, and incomplete models.” It links the attack to a financially motivated group that sells stolen access to large language models, a practice known as LLMjacking. Fireworks also reports a separate route in: a third-party cloud provider hosting Fireworks R&D machines was breached on October 23, and the attacker used it to reach Fireworks development machines on October 24.
Fireworks is working with Palo Alto Networks Unit 42 on the investigation and says it found no impact to its Inference, Training SDK or Nexus services, which keep no customer data by default. Uber hasn’t said what work Fireworks was doing with drivers’ license images.
Uber isn’t the only Fireworks customer affected. Notion says the breach exposed Notion AI chat transcripts used for its Insights feature in fewer than 1% of Notion workspaces, and that it stopped using Fireworks on November 3.
Who is affected, and how many people?
Uber’s notices go to drivers. Uber’s spokesperson called them “notices to drivers,” and the exposed data is driver’s license information. Uber hasn’t given a total, but state filings so far count roughly 16,000 people across six states. Based on the state notices and the letter’s addendum, drivers in California, Illinois, New York, Maryland, North Carolina, Pennsylvania and Washington, D.C., are also being notified.
| State | People affected | Where the number comes from |
|---|---|---|
| Texas | 4,296 (149,346 total reported) | Texas Attorney General record, November 13, via BreachTally |
| South Carolina | 3,430 | State notice, per TechCrunch |
| Iowa | about 2,999 | Uber’s letter to the Iowa AG, November 10 |
| Massachusetts | 2,567 | Massachusetts OCABR record, per TechCrunch and PCMag |
| Rhode Island | about 1,873 | Uber’s consumer letter addendum |
| Vermont | 1,071 | Vermont AG record, per PCMag |
| Illinois | Pending | Illinois filing, per TechCrunch |
| California | Not published | Sample letter on the California AG site, filed November 10 |
| Total of published state counts | about 16,236 | Our sum of the rows above (Texas residents only, not the 149,346 total) |
State counts as of November 14, 2026. Numbers will change as more states publish filings.
The 149,346 figure needs a caveat. BreachTally, a site that tracks state breach filings, says Uber’s Texas Attorney General record lists 149,346 people affected in total. Uber hasn’t confirmed that number publicly, and Texas doesn’t publish the underlying letter. Treat it as the best current estimate of total scale, not a confirmed count.
UK and other non-US drivers: every filing found so far is a US state filing. Uber hasn’t said whether drivers outside the US were affected.
What information was stolen?
Uber says the data included “images of driver’s licenses and extracted text data, including name, address, date of birth, and driver’s license number.” That wording comes from Uber’s November 10 letter to the Iowa Attorney General. The consumer letter itself leaves the list as a placeholder, so check your own letter for the exact items.
| Data type | Exposed? | Source |
|---|---|---|
| Driver’s license image | Yes | Uber’s Iowa AG letter |
| Name, address, date of birth | Yes (text extracted from the license) | Uber’s Iowa AG letter |
| Driver’s license number | Yes | Uber’s Iowa AG letter |
| Government ID number | Yes for 1,071 Vermont residents | Vermont record, per PCMag |
| Social Security number | Not listed by Uber | Uber’s Iowa AG letter |
| Bank or payout details | Not listed by Uber | Uber’s Iowa AG letter |
| Uber password | Not listed by Uber | Uber’s Iowa AG letter |
| Evidence of misuse | None found so far, Uber says | Uber’s consumer letter |
A stolen license image is a bigger risk than an email address alone. The image and the text pulled from it hold the core details used to prove who you are. That makes them useful for opening accounts in your name or for convincing phishing messages, even without a Social Security number.
Is the Uber Cyberscout letter legit?
Yes. A letter that matches Uber’s filed template is real. The sample filed with state attorneys general comes from “Uber Technologies, Inc. c/o Cyberscout, P.O. Box 3826, Suwanee, GA 30024.” It’s dated November 10, 2026, and titled “Notice of Security Incident.” It includes a personal activation code for mytrueidentity.com, the TransUnion site Cyberscout uses for enrollment.
To check a letter or email before you act on it:
- Compare the details with the filed template: the Cyberscout return address, the mytrueidentity.com enrollment site and the call center number 1-866-317-7961 (8 a.m. to 8 p.m. Eastern, Monday to Friday, except holidays).
- Type the address yourself. Go to mytrueidentity.com directly instead of clicking a link in an email or text.
- Never share your full license number, Social Security number or bank details with someone who calls or texts about this breach. The genuine letter only asks you to enter its activation code on the enrollment site.
TrustLoud covered another Cyberscout breach letter in the Frontline Education data breach, which uses the same enrollment process.
What should Uber drivers do now?
If you got a letter, enroll in the free monitoring, then freeze your credit at all three bureaus. A freeze is the strongest protection against someone opening new credit with your stolen license details. These steps follow the advice in Uber’s own letter, plus the contact details it lists.
- Enroll in the free credit monitoring. Visit mytrueidentity.com and enter the activation code from your letter. Uber’s letter says you must enroll within 90 days of the date on the letter. For a letter dated November 10, 2026, that’s about February 8, 2027. The letter template doesn’t say how many months of monitoring you get, so check your copy. Enrollment needs an email address and may not be open to anyone under 18.
- Freeze your credit. Contact each bureau: Equifax (1-800-525-6285, equifax.com), Experian (1-888-397-3742, experian.com/fraud) and TransUnion (1-800-680-7289, transunion.com/fraud-alerts). A freeze blocks new credit checks until you lift it.
- Or place a fraud alert. Uber’s letter notes that “contacting any one of the three agencies will place an alert on your file at all three.” A fraud alert tells lenders to take extra steps to confirm it’s really you.
- Pull your free credit reports at annualcreditreport.com or by calling 1-877-322-8228, and look for accounts you don’t recognize. Pennsylvania residents who can’t get a free report can ask Uber to cover the cost of one report from one bureau, according to the letter.
- Watch for license misuse. Look out for unexpected tickets, toll bills, rental agreements or account sign-ups in your name. If you see any, report it at IdentityTheft.gov (1-877-438-4338) and contact your state’s driver licensing agency.
- Expect phishing. Attackers who have your real name, address and license number can write very convincing messages. Be suspicious of any call, text or email about the breach that asks for codes, passwords or payment.
If you didn’t get a letter, Uber hasn’t identified your data as part of this incident. A free credit freeze is still a sensible step if you drive for Uber and want peace of mind. Our guide to checking whether your email has been compromised covers the account side of breach cleanup.
Is there an Uber data breach lawsuit?
We couldn’t find a filed class action over the 2026 Uber–Fireworks breach as of November 14, 2026. Breach lawsuits often follow within weeks of state filings. We’ll update this post if one is filed. Uber’s 2016 breach, which exposed license information for about 600,000 drivers, ended in a $148 million settlement with all 50 states and Washington, D.C., in September 2018 over Uber’s one-year delay in reporting it. That settlement is separate from this incident, though it did require Uber to “take precautions to protect any user data Uber stores on third-party platforms outside of Uber.”
This is Uber’s second known data breach of 2026, according to TechCrunch. Earlier this year, Uber reported a security incident at its Uber Freight trucking unit, and an extortion gang claimed it stole data.
Uber data breach timeline
| Date (2026) | What happened |
|---|---|
| October 6 | Fireworks AI identifies unauthorized use of internal credentials and starts containment (Fireworks) |
| October 7 | The attacker uses the vendor’s stolen credentials to access Uber data (Uber’s Iowa AG letter) |
| October 9 | The vendor notifies Uber, and Uber cuts its data connections. Fireworks publishes its first bulletin |
| October 13 | Uber’s investigation confirms drivers’ personal information was accessed |
| October 23–24 | A separate breach at a cloud provider gives the attacker a second path into Fireworks development machines (Fireworks update) |
| November 2–9 | Fireworks warns Notion, and Notion contacts affected workspaces on November 9 (Notion) |
| November 9 | Fireworks reports wider impact to account, billing and some dataset and model data, and links the attack to an LLMjacking group |
| November 10 | Uber starts mailing notices through Cyberscout and files with California and Iowa |
| November 11–13 | Massachusetts, Vermont and Texas records appear. TechCrunch reports on November 13 that the vendor is Fireworks AI, and Uber confirms it |
Why this breach matters beyond Uber
The Uber breach is a supply-chain breach: Uber’s own systems weren’t broken into, but a vendor’s stolen login opened data that Uber had shared with it. Because the attacker used valid credentials, Uber says its alerts never fired. The same pattern drove the ConnectWise breach TrustLoud covered in October, where a stolen app credential was used to sign in to Microsoft 365 tenants.
For companies, the lesson from Uber’s own filing is to limit what data an AI vendor can reach and watch for unusual access, even when the login looks legitimate. For drivers, the lesson is simpler. Any company you hand your license to may pass it on to vendors, so a credit freeze is worth having before the next breach notice arrives.
FAQ
Did Uber have a data breach in 2026?
Yes. Uber confirmed that an attacker used stolen credentials from its vendor Fireworks AI to access Uber data on October 7, 2026. The stolen data included drivers’ license images, names, addresses, dates of birth and license numbers. Notices started going out on November 10, 2026.
How many people were affected by the Uber data breach?
Uber hasn’t published a total. State filings count about 16,236 people in Texas, South Carolina, Iowa, Massachusetts, Rhode Island and Vermont. A breach tracker reading the Texas Attorney General’s record reports 149,346 people affected in total, but Uber hasn’t confirmed that figure.
Were Uber riders or Uber Eats customers affected?
Uber describes the notices as notices to drivers, and the exposed data is driver’s license information. Uber hasn’t said that riders or Uber Eats customers were affected, and it hasn’t said whether delivery couriers are included.
Is the Uber letter from Cyberscout real?
Yes. A letter from “Uber Technologies, Inc. c/o Cyberscout, P.O. Box 3826, Suwanee, GA 30024” that asks you to enroll at mytrueidentity.com with an activation code matches the template Uber filed with state attorneys general. Uber’s call center for the incident is 1-866-317-7961.
What is the deadline to enroll in Uber’s free credit monitoring?
You must enroll within 90 days of the date on your letter. For letters dated November 10, 2026, that’s about February 8, 2027. Enrollment is at mytrueidentity.com with the activation code in your letter.
Was my Uber password or bank information stolen?
Uber’s filing lists only driver’s license images and the text pulled from them: name, address, date of birth and license number. It doesn’t list passwords, Social Security numbers or bank details. Uber says it hasn’t identified any misuse of the data.
What is Fireworks AI, and why did it have Uber data?
Fireworks AI is a platform for running and fine-tuning open AI models. Uber says the data sat in a cloud storage environment it created specifically for the vendor’s work. Uber hasn’t said what that work involved.
Sources
- Uber Technologies, notification to the Iowa Attorney General with sample consumer letter, November 10, 2026
- Uber Technologies, sample notice on the California Attorney General’s site, November 10, 2026
- Fireworks AI, October 2026 security incident (October 10, 2026) and update (November 9, 2026)
- Notion, Fireworks AI incident advisory, updated November 13, 2026
- TechCrunch, Uber confirms hackers stole thousands of drivers’ license information, November 13, 2026
- PCMag, Uber says hackers stole driver’s license data via third-party Fireworks AI, updated November 14, 2026
- Reuters via Investing.com, Uber says US drivers’ license data stolen in data breach, November 13, 2026
- BreachTally, Uber Technologies case file, state records as of November 14, 2026
- Texas Attorney General, 2018 Uber settlement announcement
