Incident timing: Vendor notified Uber on October 9, 2026. The intrusion date at the vendor is not stated in the report.
What Uber has told regulators and drivers
Uber filed notices with several US state attorneys general, including California. In them it said its vendor told it on October 9 that attackers had broken in and stolen internal credentials, which were then used to reach Uber data. Uber has started telling affected drivers that their personal information was stored with that vendor. Asked about the vendor, an Uber spokesperson pointed questions to Fireworks.
How many people are involved
TechCrunch reviewed breach notices that list driver's licence information for 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island. An Illinois filing shows some residents were affected, but the count was still pending. Uber did not say how many California drivers were notified or give a total. The figures are expected to rise as more notices are filed.
What is still unknown
Fireworks confirmed unauthorised access to some of its systems that affected customer data. It did not answer TechCrunch's specific questions about this incident. The company has attributed the attack to a financially motivated group that sells access to large language model services. No group has taken credit for the data theft.
Why it matters
Driver's licence details are useful for identity fraud. Drivers who receive notices should follow the steps in them and treat unexpected calls or messages that cite the breach with caution.
Source & attribution
Read the original reporting at TechCrunchAI-assisted summary prepared for Castler editorial review. Evidence labels describe the source of a claim, not a guarantee that every detail of an investigation is settled.