Uber Driver Data Breach Exposes Identity Records - LinkedIn
Uber is notifying drivers after attackers used compromised credentials from supplier Fireworks AI to access personal information, including driving licence details.
The incident has brought renewed scrutiny to the sensitive data and access permissions companies entrust to external artificial intelligence providers. Uber confirmed that Fireworks AI was the vendor involved in the driver notifications, with initial state-level reporting identifying thousands of affected people, while newer breach-tracking records point to a substantially larger population.
Compromised Supplier Credentials
According to Uber's notification filed with California's attorney general, the supplier informed Uber on 9 October 2026 that an unauthorised party had obtained internal credentials and used them to access Uber's account with the provider. Uber immediately disconnected its data connections with the supplier and began investigating.
By 13 October, investigators had established that the compromised credentials had been used to access Uber information, including personal records belonging to notification recipients. The notification letter is dated 10 November, while California's separate breach register entry records 7 October as the breach date.
Wider Impact Revealed
Early reporting documented 2,567 affected people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island. A newer record published by BreachTally lists 149,346 affected individuals overall, including 4,296 Texas residents. Both trackers also list names, addresses, dates of birth, driving licence numbers and government-issued identification numbers among the information involved.
Fireworks Security Events
In its initial security bulletin, Fireworks said it detected unauthorised use of internal credentials on 6 October, exposing environment variables used in evaluation jobs for a limited number of customer accounts, including secrets such as API keys and tokens. At that stage, the company said it had not detected unauthorised access to customer personal information, models, datasets or inference traffic.
The distinction between stolen data and stolen access credentials is significant. Credentials can provide a route to other resources, so an investigation must establish both what an attacker obtained initially and what those credentials subsequently allowed them to reach.
LLMjacking Market
Fireworks linked the activity to financially motivated criminals seeking to monetise unauthorised access to large language models, a practice known as LLMjacking. A November report from Google Threat Intelligence Group and Mandiant describes how criminals acquire valid credentials or access exposed model services, then resell the resulting computing capacity through illicit gateways.
Driver Protection Measures
Uber's notification says it had not identified misuse of recipients' information at the time of writing. It offers complimentary credit monitoring and fraud assistance through Cyberscout, a TransUnion company, with enrolment required within 90 days. The Federal Trade Commission recommends using offered protective services and consulting IdentityTheft.gov for steps tailored to the information exposed.
Unanswered Questions
The incident leaves several questions for Uber and its provider: why the affected identity information was accessible through the supplier relationship, what permissions enabled that access, and what changes will prevent a recurrence. For drivers, clear individual notifications and accessible assistance will matter more than broad assurances about the security of the platform.
Related
