Uber Technologies has disclosed a data breach tied to third-party artificial intelligence vendor Fireworks AI, in which an unauthorised party stole internal credentials and used them to access Uber-related data, including sensitive personal information belonging to drivers. The company became aware of the incident on 9 October 2026 and has since severed its data connections with Fireworks.ai while conducting a full investigation.

How the Breach Occurred

According to reports, the attacker obtained Fireworks AI's internal credentials without authorisation and leveraged them to reach Uber's data environment. The compromised information included US driver's licence details — a category of sensitive personal data that can facilitate identity fraud. Uber confirmed it notified affected drivers about the security incident at its third-party vendor.

Scale of the Exposure

Uber has not publicly disclosed the total number of individuals impacted by the breach. However, official notifications submitted to authorities in several US states — including Massachusetts, South Carolina, and Rhode Island — indicate thousands of people may have been affected. A state-level notification confirmed that 1,873 individuals in Rhode Island alone were impacted, with supplementary notices dispatched to residents in Washington and at least five other states.

What Uber Is Offering Affected Individuals

The ride-hailing company is providing affected persons with 90 days of complimentary credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Eligible recipients must enrol within 90 days of receiving their notification letters. Uber stated it has found no evidence that the exposed information has been misused to date.

Broader Context: Uber's Operational Shifts

This breach comes amid a period of significant restructuring at Uber. In July 2026, the company cut nearly 10% of its customer service workforce as it reshaped operations around artificial intelligence and a leaner organisational structure. Those layoffs affected employees in Uber's community operations division, which handles customer support. The growing reliance on AI vendors — such as Fireworks AI — reflects the company's strategic direction, but the incident underscores the security risks that accompany third-party AI integrations. Notably, this is not Uber's first brush with a major data security incident; the company has faced scrutiny over data protection practices in past years as well.

What Happens Next

Uber's investigation into the full extent of the exposure remains ongoing. Regulators in the affected states will likely scrutinise whether Uber's vendor oversight protocols met applicable data protection standards. The incident is expected to reignite debate around third-party AI vendor liability and the adequacy of current data-sharing frameworks in the ride-hailing and gig-economy sectors.