Cybersecurity

Uber Says Hackers Took Drivers' License Images Through Its AI Vendor Fireworks

State breach filings show attackers used credentials stolen from Fireworks AI to reach a cloud storage area Uber set up for the vendor, taking license photos, names, addresses and birth dates. Filings from five states alone cover nearly 12,000 people, and the count is still rising.

DailyMech Staff

Published

Last updated / Fact-checked on

Uber Says Hackers Took Drivers' License Images Through Its AI Vendor Fireworks
1857643 / Pixabay — Pixabay Content License

View from the back seat of a driver's hands on the steering wheel of a car on a city street

Illustrative photo of a driver at the wheel. It does not show an Uber driver or anyone affected by the breach.

Uber has begun notifying drivers in at least several U.S. states that images of their driver's licenses were stolen in an October breach at one of its technology providers. TechCrunch reported on Nov. 13 that the provider is Fireworks AI, the startup that lets developers run and fine-tune open AI models, and Uber confirmed the link in a statement to TechCrunch and PCMag.

"The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data," an Uber spokesperson said, according to both outlets. Uber referred further questions to Fireworks.

The disclosure puts Uber alongside Notion, which has told customers that some "unattributable" Notion AI chats were exposed, as a Fireworks customer confirmed to have lost data in the intrusion. It is also a clear example of a growing risk: sensitive data handed to an AI vendor for processing becomes only as safe as that vendor's credentials.

At a glance

Item Detail Source
Vendor Fireworks AI TechCrunch; Uber statement
Access date Oct. 7, 2026, using the vendor's compromised credentials Iowa filing
Uber notified Oct. 9, 2026 Iowa filing; consumer notice
Data License images and extracted name, address, date of birth and license number Iowa filing
Reported counts Iowa ~2,999; South Carolina 3,430; Massachusetts 2,567; Rhode Island 1,873; Vermont 1,071 Iowa filing; TechCrunch; PCMag
Offer to drivers Free credit monitoring and fraud assistance through Cyberscout Consumer notice

What Uber told regulators

Uber's most detailed account so far is a Nov. 10 letter to the Iowa Attorney General, filed on its behalf by the law firm Ashurst Perkins Coie. It says a service provider told Uber on Oct. 9 that an unauthorized third party had compromised the provider's internal credentials and used them to access Uber's account with that provider. Uber says it immediately cut its data connections with the provider and opened an investigation, which concluded on Oct. 13 that the intruder had used the credentials on Oct. 7 to reach Uber data containing personal information.

The letter is unusually specific about the data. It lists images of driver's licenses and text extracted from them: name, address, date of birth and license number. That combination is what an identity thief needs to impersonate someone, and unlike a password it cannot be changed.

It is also specific about where the data sat. Uber says the files were in a cloud storage environment it created specifically to enable the provider's work, covered by Uber's cloud security processes and overseen by its Cloud Security team. Alerting was turned on. But because the intruder used valid credentials and data flows that the provider's systems were already allowed to use, no alerts fired. Uber says the stolen credentials did not open any other Uber systems, that it has deleted or rotated credentials tied to the provider, and that the provider has revoked the compromised ones. The investigation is continuing.

How many people

Uber has not given a total. The Iowa filing covers approximately 2,999 residents. TechCrunch, citing notices it reviewed, counted 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island; an Illinois filing showed affected residents with the number still pending, and California drivers were notified without a count. PCMag added Vermont, where the state's site lists 1,071 people with government ID numbers exposed, and said the notice template points to drivers in New York, Maryland, North Carolina and Washington, D.C., as well.

The five states with published figures add up to about 11,940 people, by DailyMech's count. That is a floor. Both outlets expect the number to rise as more state notices are posted.

Uber's letter to drivers says it has not identified any misuse of the data so far. It offers free credit monitoring and fraud assistance from Cyberscout, a TransUnion company, with enrollment required within 90 days, and recommends that drivers watch their statements and consider a fraud alert or credit freeze.

The Fireworks side

Fireworks first disclosed a security incident on Oct. 9. In an update last revised Nov. 9, it said that beyond the stored secrets it initially reported, it had found impacts to account and billing information and, for a limited set of accounts, to secrets, datasets and incomplete model weights. It linked the attack to a financially motivated group trying to sell stolen access to large language models, a practice known as LLMjacking, and described a separate Oct. 24 intrusion that came through a third-party cloud provider hosting its research machines. Fireworks says payment card numbers were not affected and that it has seen no impact to its inference, training SDK and Nexus products, which it says are zero data retention by default.

A Fireworks spokesperson confirmed to TechCrunch that unauthorized access to some of its systems affected customer data but did not answer specific questions. TechCrunch noted that no known criminal group has claimed the theft, and that this is Uber's second known breach this year, after an incident at its Uber Freight unit.

Why it matters

Most corporate breach stories are about a company's own systems. This one is about the permissions a company grants to a vendor. Uber's own account says its monitoring worked as designed and still saw nothing, because the intruder looked exactly like the trusted vendor. As companies send more documents, images and records to AI providers for extraction and model training, that gap grows.

For security teams, the practical questions are concrete: which vendors hold standing credentials to your storage, what those credentials can read, and whether anything would look unusual if they were stolen. For drivers, the advice is simpler: enroll in the monitoring, and watch for accounts opened in your name.

Watch for Uber's total count, for whether other Fireworks customers disclose losses, and for any action by state attorneys general.

How we reported this

DailyMech read TechCrunch's and PCMag's reports, Uber's Nov. 10 filing with the Iowa Attorney General and Fireworks AI's latest security bulletin in full. The five-state total is DailyMech's own sum of published figures. The Vermont figure comes from PCMag only. DailyMech contacted no one for this article.

Published November 14, 2026. Facts checked against the cited sources by DailyMech's AI writer.

Sources

DailyMech used AI tools to research and draft this article. Facts were checked against the cited sources by DailyMech's AI writer, not by a human editor.

In Cybersecurity

From other sections

Sections