Uber Says US Drivers’ License Data Stolen in Data Breach Tied to Service Provider
Uber said on Friday that an unauthorized party used compromised credentials at one of its service providers to access company data, including U.S. drivers’ license information, according to a breach notice posted on the California attorney general’s website.
The disclosure, reported by Reuters on Friday, November 13, 2026, marks the latest security incident for the ride-hailing company, and it underlines a familiar risk for large technology firms: an attack that begins not inside their own systems, but at a third-party vendor.
What happened
According to the notice, which is dated November 10, the service provider told Uber on October 9 that its credentials had been compromised and used to access Uber’s account with the provider. Uber said it severed its data connections with the provider and opened an investigation.
On October 13, the investigation determined that the unauthorized party had used the credentials to access Uber data, and that the personal information of affected people was among the data accessed, the notice said.
The notice itself did not name the provider or list the specific data involved. TechCrunch reported on Friday that the provider was Fireworks AI, an artificial intelligence company, and that the data included drivers’ license information. Uber and Fireworks AI did not immediately respond to Reuters’ requests for comment.
The notice said the incident affected about 1,873 Rhode Island residents. That figure comes from the state filing, and the notice did not specify the total number of people affected nationwide.
What Uber is offering affected people
Uber said it is offering affected people free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Affected individuals are being notified under state breach-notification rules, which require companies to alert residents whose personal information was exposed.
Driver’s license numbers are particularly sensitive because they can be used in identity theft, including opening accounts or creating fake identification documents. Security experts routinely advise anyone whose license data is exposed to monitor their credit reports and watch for unfamiliar accounts or activity.
Background: Uber’s history with data breaches
The incident recalls a far larger breach Uber disclosed in 2017, in which hackers stole personal data belonging to 57 million riders and drivers in 2016. That breach led to a $148 million settlement with state attorneys general in 2018, after investigators found the company had waited a year to disclose it.
Since then, Uber has invested heavily in security, but Friday’s disclosure shows how vendor access can still create exposure. When a company grants a service provider access to its systems, compromised credentials at that provider can become a route into the company’s data.
Related Articles
Why this matters
Third-party breaches have become one of the most common ways attackers reach large companies. A vendor’s login credentials may carry access to customer records, internal tools, or cloud systems, and a single compromised account can open the door to sensitive data.
For drivers, the stakes are direct. A driver’s license is a government-issued identity document, and unlike a password, it cannot simply be changed. That makes this kind of exposure harder to fix than a leaked email address or phone number.
Related reading: Hackers Stole AI Keys From 100,000 Railway Workspaces and Google Patches Eighth Actively Exploited Chrome Zero-Day of 2026.
Latest developments
Uber has cut off its data connections with the provider involved, and its investigation into the incident is continuing. The company has not said how many people were affected in total, or whether the stolen information has been misused. The disclosure became public on Friday through the state attorney general’s breach-notification filing, and more details are expected as the investigation proceeds.
Frequently asked questions
What data was stolen in the Uber breach?
According to TechCrunch, the data included U.S. drivers’ license information. Uber’s notice said the personal information of affected people was among the data accessed, without listing every data type involved.
How did the breach happen?
An unauthorized party used compromised credentials belonging to one of Uber’s service providers to access Uber’s account with that provider. TechCrunch identified the provider as Fireworks AI.
How many people were affected?
The breach notice cited about 1,873 Rhode Island residents. The total number of affected people nationwide has not been specified.
What is Uber doing for affected people?
Uber is offering free credit monitoring and fraud assistance through Cyberscout, a TransUnion company, and is notifying affected individuals under state breach-notification rules.
Uber’s disclosure is a reminder that even companies with large security teams can be exposed through their vendors. For drivers whose license data was taken, the company’s credit monitoring offer is a first step, but the longer-term risk of identity theft is one they will need to watch for months to come.
Sources
- Reuters, “Uber says US drivers’ license data stolen in data breach” (November 13, 2026): https://kwsn.com/2026/11/13/uber-says-us-drivers-license-data-stolen-in-data-breach/
- TechCrunch reporting on the breach (via Reuters, November 13, 2026), identifying the provider as Fireworks AI
- Uber data breach notice, California Attorney General’s website (dated November 10, 2026)
