Uber, the prominent ride-sharing giant, has recently disclosed a significant data security incident affecting its users. The breach occurred due to the theft of account credentials belonging to a third-party service provider, which unauthorized individuals exploited to gain access to sensitive information stored by Uber. This compromised data includes personal details of some users, and regulatory sources indicate that driver’s license information may also be involved.
On November 10, Uber submitted a notification regarding the data breach, as published by the California Attorney General’s Office. The incident reportedly took place on October 7. Subsequently, on October 9, the affected service provider alerted Uber that its account credentials had been compromised. These credentials were then used by malicious actors to unlawfully access Uber’s data hosted by the provider.
In response to the notification, Uber promptly severed its data connection with the service provider and initiated an internal investigation. By October 13, the investigation confirmed that unauthorized entities had indeed accessed the data stored with the third-party provider using the stolen credentials, which included some personal information of those impacted.
In a communication sent to affected individuals, Uber stated, “On October 13, 2026, our investigation confirmed that unauthorized individuals used stolen credentials to access data stored with that service provider. We are notifying you because our investigation shows that your personal information is included in the accessed data.”
As of the time the notification was issued, Uber indicated that there had been no signs of misuse related to the compromised data.
Uber’s public announcement did not specifically name the third-party service provider involved, nor did it elaborate on the exact types of personal data that were accessed. However, reports from the technology media outlet TechCrunch suggest that the provider is Fireworks AI, an artificial intelligence platform, and the leaked data may include driver’s license details. Reuters echoed this report, but Uber’s public communication has not confirmed the identity of the service provider or the specific nature of the leaked data.
Current regulatory documents indicate that this incident affects residents across multiple states. In Rhode Island, approximately 1,873 residents have been impacted; reports also indicate that South Carolina is home to around 3,430 affected individuals, while Massachusetts has about 2,567 residents involved. It is important to note that these figures do not represent the total number of individuals affected nationwide.
Additionally, the notification includes supplementary information specific to residents of Washington D.C., Maryland, North Carolina, New York, and Pennsylvania.
To assist those affected, Uber has announced that it is offering complimentary credit monitoring and fraud assistance services through Cyberscout, a subsidiary of TransUnion, one of the three major personal credit reporting agencies in the United States. Individuals receiving the notification can register for these services within 90 days from the date the notice was sent.