AI Vendor Hack Hit Uber: 7,870 Driver Licenses in 3 States

Uber is notifying drivers that their personal and driver’s license information was stolen in an October breach at one of its tech providers, and TechCrunch reported on 13 November that the provider is Fireworks AI, which lets developers access and use open AI models. State notices cited by TechCrunch list 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island: 7,870 across three states, by our arithmetic, with Illinois and California counts not given.

Uber’s own notice letter, filed with the California Attorney General, says a service provider told Uber on 9 October that an unauthorized third party had “compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider”. The letters are dated 10 November, 32 days after that notice, by our count.

Business Pill · Embedded Dependency

An evergreen Business Engineer explainer on embedded dependencies: what is inside what you buy. It teaches the general idea only and does not discuss Uber or Fireworks.

What Uber’s Notice Says

The sample letter says that after being notified, “Uber immediately severed data connections with the service provider and launched an investigation”. On 13 October, it says, the investigation “determined that the unauthorized party had used the compromised credentials to access Uber data connected to the service provider”.

The California listing gives the date of the breach as 7 October 2026. The letter offers credit monitoring and fraud assistance through Cyberscout, a TransUnion company, and says: “we have not identified any misuse of your data to date”. The template does not name the service provider.

An Uber spokesperson told TechCrunch: “The notices to drivers are in relation to a security incident impacting one of our third-party vendors”. Uber did not say how many drivers or customers were affected in total, TechCrunch reported.

The Fireworks Link

TechCrunch wrote: “TechCrunch has learned that the provider is Fireworks AI, which lets developers access and use open AI models”. Fireworks told TechCrunch that “the company identified a security issue involving unauthorized access to some of its systems, which affected customer data”, and did not answer detailed questions, the outlet reported.

Fireworks attributed the breach to a financially motivated cybercriminal group that sells stolen LLM access tokens, according to TechCrunch, and no group has claimed the data theft. Fireworks, valued at $17.5 billion in July, identified a first security incident on 6 October and says a third party reached its development machines on 24 October, as our piece on the second Fireworks breach reported. The 7 October breach date on Uber’s filing is one day after that first incident, by our count.

Uber is the second named customer. Notion said the Fireworks incident affected under 1% of its workspaces and disconnected from Fireworks by 3 November, as our Notion piece covered.

Why an AI Vendor Breach Reaches the Client

Uber’s letter describes the route at a business level: the provider’s own credentials were taken and used to reach Uber’s account with that provider, and through it Uber data connected to the service. The data sat with the vendor because Uber had connected it there, which is why Uber’s first step, per its letter, was to sever those connections.

TechCrunch noted this is Uber’s second known data breach this year, after an incident “at its Uber Freight truck shipping unit, for which an extortion gang took credit for stealing data”.

The Structural Read

As we read the letter, Uber’s first move was to sever data connections with the provider; the scope of a vendor breach is set by what the client connected, not by the client’s own defences.

As we read TechCrunch together with our earlier reporting, Uber joins Notion as a named Fireworks customer whose data was reached, and the breach date Uber filed in California, 7 October, sits one day after Fireworks’ first incident, by our count.

Three Implications

FOR ENTERPRISES BUYING AI INFERENCE Uber’s letter shows a vendor’s credentials can open the client’s account at that vendor; what is connected to an AI provider is part of the client’s exposure.

FOR FIREWORKS Uber is the second named customer after Notion, per TechCrunch and Notion’s advisory.

FOR DRIVERS Uber offers credit monitoring through Cyberscout and says it has not identified misuse to date.

The Business Engineer Lens

This story maps onto the Business Engineer framework The State of The Inference Economy.

The framework describes inference as “continuous, distributed across millions of applications and agents, incurring marginal cost with every query”.

As we read it, that distribution is also a dependency: each application routing queries through a third-party inference provider connects data to that provider, which is the link Uber’s letter describes. The framework does not discuss Uber or Fireworks.

What Is Not Established

Uber’s template does not name Fireworks; the link rests on TechCrunch’s reporting, and the Fireworks statement TechCrunch quotes does not name Uber. The 7,870 figure covers only the three states whose counts TechCrunch cited; Illinois and California counts were not given, so it is a floor, not a total. Which data elements each driver lost varies by letter, and the template leaves them blank.

We have not seen what the data was used for; Uber says it has not identified misuse to date. We did not contact the companies for this piece.

The Bottom Line

Uber says a service provider’s stolen credentials gave a third party access to Uber data connected to that service, and TechCrunch reports the provider is Fireworks AI. Three state notices alone add up to 7,870 people, by our arithmetic, and Uber’s letters went out 32 days after the provider’s 9 October warning.