Uber Driver Data Exposed in Fireworks AI Breach Using Stolen Credentials

Uber confirmed that attackers used compromised internal login credentials to access its account at third-party provider Fireworks AI, exposing U.S. drivers’ personal information, including driver’s license details. State disclosures identified 7,870 affected individuals across Massachusetts, South Carolina, and Rhode Island; additional states were involved, but the nationwide total remains undisclosed. Uber learned of the incident on October 9, 2026, immediately disconnected its data connections with the provider, and confirmed unauthorized access to Uber data on October 13.

Uber’s November 10 notification said no misuse of the affected information had been identified and offered free credit monitoring and fraud assistance through Cyberscout. Notion was also affected by the provider breach. Fireworks AI attributed the attack to a financially motivated group seeking to sell stolen tokens used to access large language models, highlighting the exposure created by compromised credentials and sensitive data held by AI service providers.