Uber Data Breach 2026 Driver's License Info Stolen

Uber is notifying thousands of U.S. drivers that their personal information, including driver’s license details, was accessed after an attacker used stolen credentials belonging to an outside technology provider. Uber has confirmed the provider is Fireworks AI, a company that helps developers run AI models.

State filings show at least 7,870 people in Massachusetts, South Carolina and Rhode Island alone. Uber has not published a nationwide total. Uber says it has not found any misuse of the information so far, and it is offering free credit monitoring through Cyberscout, a TransUnion company. You must enroll within 90 days of the date on your letter.

There is no verified class action, putative class action or settlement tied to this incident, and no cash payment has been announced.

Uber Data Breach 2026: Quick Facts

Detail	Verified information
Company	Uber Technologies, Inc.
Vendor involved	Fireworks AI
How it happened	Unauthorized party used compromised credentials at the vendor
Breach date listed in California’s database	October 7, 2026
Vendor notified Uber	October 9, 2026
Uber confirmed its data was accessed	October 13, 2026
Notification letter date	November 10, 2026
Public reporting	November 13, 2026
Data reported stolen	Driver’s license information; other categories vary by person
Confirmed in three states	About 7,870 people
Nationwide total	Not disclosed
Free protection	Credit monitoring and fraud assistance (Cyberscout / MyTrueIdentity)
Enrollment deadline	90 days from the date on your letter
Breach helpline	1-866-317-7961 (Monday to Friday, 8 a.m. to 8 p.m. Eastern Time, excluding holidays)
Class action or settlement	None verified as of November 14, 2026

What Happened in the Uber Driver Data Breach?

According to Uber’s notice filed with the California Attorney General, an unauthorized person obtained internal credentials belonging to one of Uber’s service providers and used them to reach Uber-related data connected to that provider.

The vendor told Uber about the compromise on October 9, 2026. Uber says it immediately cut its data connections with the provider and started an investigation. On October 13, investigators concluded that the intruder had used the credentials to access Uber data, and that personal information of the people being notified was part of it.

Uber Breach Timeline

Date	Event
October 7, 2026	Breach date recorded in California’s breach database
October 9, 2026	Fireworks AI notified Uber of the credential compromise
October 13, 2026	Uber determined its data, including personal information, was accessed
November 9, 2026	Fireworks AI published an updated security investigation report
November 10, 2026	Uber’s notification letter is dated; sample notice filed with California
November 13, 2026	TechCrunch reported the vendor’s name and that driver’s license information was taken

These dates mark different stages of discovery and notice. They do not mean every record was accessed on the same day.

What Information Was Stolen From Uber Drivers?

TechCrunch reported, and state records indicate, that driver’s license information was among the stolen data. That matters because a license number is a government-issued identifier that criminals can use in identity-verification and fraud attempts.

Uber’s public California filing is a sample letter with a blank where each person’s data types would be listed. So the public record does not prove every driver had the same information exposed. Read the section of your own letter titled “What Information Was Involved.”

Data type	Status in the Uber incident
Driver’s license information	Reported as stolen
Other identifying details	Access confirmed; categories vary by individual
Social Security numbers	Not established for everyone
Bank account or routing numbers	Not established
Payment card details	Not established
Uber account passwords	No blanket confirmation
Trip history	Not established

Were Uber riders and Uber Eats customers affected?

The reporting so far concerns drivers. Uber has not publicly said that riders, Uber Eats customers or delivery workers were affected. Getting an Uber service does not mean you are part of this breach.

Uber Data Breach 2026, Driver's License Information Stolen, Who Is Affected and What to Do

Which States Are Affected by the Uber Data Breach?

State	Reported affected individuals
South Carolina	3,430
Massachusetts	2,567
Rhode Island	Approximately 1,873
Combined (three states)	7,870
California	Notified; count not disclosed in the sample filing
Illinois	Some residents affected; count not established

Uber’s multistate notice also carries state-specific information for residents of the District of Columbia, Maryland, New York, North Carolina and Pennsylvania, and one report mentioned Vermont. A state appearing in the addendum does not tell you how many of its residents were affected.

The 7,870 figure is not Uber’s nationwide count. It is only the sum of the three states that published numbers. The real total is likely higher.

See the California Attorney General’s Uber breach filing for the official notice.

What Is Fireworks AI and Why Did It Have Uber Driver Data?

Fireworks AI provides infrastructure that lets businesses and developers deploy and use AI models. Uber confirmed to reporters that Fireworks was the compromised provider. This is a third-party breach: the attacker went after a vendor and used that access to reach a customer’s information.

Fireworks first disclosed its own incident in October 2026. In its November 9 update, it described effects on some account and billing data, stored credentials, datasets and incomplete models, and a separate October 23 incident involving development infrastructure. It linked the activity to a financially motivated group trying to obtain and resell access to large language model services. Notion has also confirmed that some of its customers’ data was exposed through Fireworks.

Those findings cover Fireworks’ broader investigation. They do not show that every category of Fireworks data was part of Uber’s incident.

Did an AI model steal Uber drivers’ data?

No evidence says so. The reported intrusion used compromised credentials. Nothing public shows Uber driver data was used to train a public AI model or shown in chatbot answers.

Read Fireworks AI’s November 9 security update.

How to Check If Your Uber Driver Information Was Exposed

There is no verified public lookup tool where a driver can type in a name or license number. Be careful with any website offering one; do not enter your license or Social Security number on an unfamiliar site.

Check your postal mail for a letter from Uber Technologies, Inc. about a security incident.
Check the email on your driver account, including spam.
Read which data categories your letter lists.
If you think you were affected but got nothing, call 1-866-317-7961 (Monday to Friday, 8 a.m. to 8 p.m. Eastern Time, excluding holidays).
Confirm your mailing address through Uber’s official support channels.

Former drivers should not assume they are excluded. Notice depends on whose data was accessed, not on whether you still drive.

How to Get the Free Uber Breach Credit Monitoring

Uber is offering eligible recipients free credit monitoring and fraud assistance through Cyberscout on the MyTrueIdentity platform.

Find your notification letter and the activation code in it.
Go to MyTrueIdentity.com.
Enter your activation code.
Create or activate your account and complete any identity verification.
Save your confirmation.

If you already have a MyTrueIdentity account, log in and use the membership option to apply the new code.

Uber breach credit monitoring deadline

You must enroll within 90 days of the date on your letter. For a letter dated November 10, 2026, that is about February 8, 2027. Follow the date in your own letter. The public sample leaves the length of coverage blank, so check your letter for it.

This offer is a protective service, not a settlement or compensation, and it is not an admission of liability.

What to Do If Your Driver’s License Number Was Stolen

A stolen license number raises the risk of impersonation. It does not by itself let someone empty your bank account, suspend your license or open a loan. The real risk depends on what else was taken and whether anyone tries to use it.

Enroll in the free monitoring using your activation code.
Freeze your credit with Equifax, Experian and TransUnion. Each bureau must be contacted separately, and freezes are free.
Review your credit reports at AnnualCreditReport.com for unfamiliar accounts, inquiries or addresses.
Secure your Uber and email accounts with unique passwords and extra sign-in protection. Attackers use stolen details to write convincing fake Uber messages.
Watch bank and card activity and report unfamiliar charges right away.
Keep records: the letter, suspicious messages, expenses and any evidence of misuse.
Call your state licensing agency (DMV) if you see fraud tied to your license and ask about its identity-theft process.

A breach does not automatically require replacing a valid license, and a new card may not change the underlying license number.

Protection	What it does
Credit freeze	Blocks most new-credit lookups on your file
Initial fraud alert	Tells lenders to take extra steps to verify you; one bureau must pass it to the other two
Credit monitoring	Alerts you to certain changes or suspicious activity
Identity-theft recovery help	Assists you if misuse happens

Can Uber Drivers Sue Over the 2026 Data Breach?

Possibly. It depends on what data was taken, which state’s law applies, Uber’s and Fireworks’ security practices, and whether a legally recognized injury resulted. A breach alone does not prove anyone was negligent.

Claims in a future suit could involve negligence, failure to keep reasonable security, breach of contract, or violation of state privacy and consumer-protection laws. Three practical hurdles often decide these cases:

Standing. In TransUnion LLC v. Ramirez (2021), the U.S. Supreme Court held that a plaintiff in federal court needs a concrete harm, not just a statutory violation or risk. Courts often split on whether a stolen identifier with no misuse is enough, which is one reason state courts and state statutes matter.
Arbitration. Uber’s driver agreements have historically included arbitration terms. Whether any apply to a claim over this breach, and whether they are enforceable, is a question for a court. Drivers who may have signed one should read their agreement or ask a lawyer.
Who is responsible. Claims may target Uber, Fireworks, or both. Responsibility for vendor oversight is not decided.

Has a class action been filed over the Uber breach?

As of November 14, 2026, no putative class action over this incident has been verified. At least one law firm has said publicly that it is investigating. An investigation announcement is not a lawsuit, a certified class or a settlement. There is no verified settlement website, claims administrator, payout amount or claim deadline.

For comparison, a real data breach settlement has court-approved terms and deadlines, like the Lowe Engineers Data Breach Settlement, $50 Cash or Up to $5,500 in Documented Losses, Plus Two Years of Credit Monitoring. That case is unrelated to Uber and gives Uber drivers no rights.

Laws That Apply to the Uber Data Breach

Because affected drivers live in many states, no single law governs. These are the main statutes. Whether a given law was followed or violated is not something the public record settles.

California

Cal. Civ. Code § 1798.82 (breach notification). Requires notice to California residents when unencrypted personal information, including name plus driver’s license number, is acquired without authorization. As amended effective January 1, 2026, notice generally must go out within 30 calendar days of discovery or notification, subject to exceptions for law enforcement and investigation. A breach affecting more than 500 residents also requires a sample notice to the Attorney General, which is the filing Uber made.
Cal. Civ. Code § 1798.81.5 (reasonable security). Requires businesses that own or license California residents’ personal information to maintain reasonable security.
Cal. Civ. Code § 1798.150 (private right of action, CCPA). Lets a consumer sue when certain personal information is stolen because a business failed to maintain reasonable security. Statutory damages are $107 to $799 per consumer per incident, or actual damages if greater, following the CPPA’s inflation adjustment effective January 2025. Before seeking statutory damages the consumer generally must give 30 days’ written notice and an opportunity to cure. This is not an automatic payout; the elements must be proven.

Massachusetts

M.G.L. c. 93H § 3. Requires notice to the Attorney General, the Office of Consumer Affairs and Business Regulation, and affected residents as soon as practicable and without unreasonable delay. Driver’s license numbers are covered when combined with a resident’s name.
201 CMR 17.00. Requires a written information security program for personal information of Massachusetts residents.
M.G.L. c. 93H § 3A. Requires free credit monitoring only when a Social Security number is involved. That has not been shown for Uber drivers.

South Carolina

S.C. Code § 39-1-90. Requires notice in the most expedient time possible and without unreasonable delay. It also lets an injured resident sue for actual damages from a violation, and allows administrative fines for knowing and willful violations. It creates no payment just because your name is in a report.

Rhode Island

R.I. Gen. Laws § 11-49.3-4. Requires notice when unauthorized access creates a significant risk of identity theft, generally within 45 days of confirmation, and sets what the notice must say.
R.I. Gen. Laws § 11-49.3-2. Requires reasonable security procedures for personal information.

Illinois

Personal Information Protection Act, 815 ILCS 530. Covers driver’s license numbers, requires notice to affected residents, and requires notice to the Attorney General when more than 500 Illinois residents are affected. A violation is treated as an unfair practice under the Consumer Fraud Act.

States named in Uber’s multistate notice

New York, N.Y. Gen. Bus. Law §§ 899-aa and 899-bb (SHIELD Act). Notice duties, plus reasonable safeguards for private information.
Maryland Personal Information Protection Act, Md. Code, Com. Law § 14-3501 et seq. Notice generally within 45 days of the business determining a breach occurred.
North Carolina Identity Theft Protection Act, N.C. Gen. Stat. § 75-65. Notice to residents and to the Attorney General’s Consumer Protection Division.
Pennsylvania Breach of Personal Information Notification Act, 73 P.S. § 2301 et seq. Notice duties, with credit monitoring requirements that apply for certain data types.
District of Columbia, D.C. Code § 28-3851 et seq. Notice to residents and to the Attorney General above a threshold.
Vermont, 9 V.S.A. § 2435. Notice to the Attorney General and residents, generally within 45 days.

Federal law

FTC Act § 5, 15 U.S.C. § 45. The FTC can act against unfair or deceptive data-security practices. It gives consumers no private right to sue for damages.
Fair Credit Reporting Act, 15 U.S.C. § 1681c-1 and § 1681c-2. Gives you the right to place free security freezes and fraud alerts and to have information resulting from identity theft blocked from your credit file. These protections work even if no lawsuit is ever filed.
Driver’s Privacy Protection Act, 18 U.S.C. § 2721 et seq. Restricts disclosure of personal information from state motor vehicle records. It may not apply here, because Uber collects license details from drivers directly rather than from a DMV. Whether it applies is a question for a court, not a settled fact.

What If Someone Misuses Your Stolen Information?

If you find a fraudulent account, loan or other misuse, contact the lender and dispute it, confirm your credit freezes, and report the identity theft to the FTC at IdentityTheft.gov, which provides a recovery plan and dispute letters. Keep credit reports, letters and out-of-pocket costs. Documentation like this is what real settlements often require, as in the Grayback Forestry Data Breach Class Action Settlement, $65 Cash or Up to $5,000, Plus 3 Years of Credit Monitoring, which does not give Uber drivers any payment right.

Is This the Same as Uber’s 2016 Data Breach?

No. The 2016 incident exposed about 57 million rider and driver records, including about 600,000 U.S. drivers’ license numbers, and Uber was criticized for paying the attackers and delaying disclosure. The October 2026 incident involves a different vendor and different facts. Do not combine the numbers, and do not assume a 2016 resolution applies to 2026.

Uber Data Breach 2026 FAQ

Was Uber hacked in 2026?

Uber confirmed that an unauthorized party accessed Uber-related data using compromised credentials at an outside service provider. The incident is tied to October 2026.

Was Fireworks AI responsible for the Uber breach?

Fireworks AI was the compromised provider, according to Uber’s confirmation to reporters. Whether either company broke a legal duty has not been decided.

How many Uber drivers were affected?

At least 7,870 people across Massachusetts, South Carolina and Rhode Island. The nationwide total has not been disclosed.

What information did the Uber breach expose?

Driver’s license information was reported stolen. Other data categories differ by person and are listed in each personal letter.

Were Social Security numbers stolen in the Uber breach?

The public records reviewed do not establish that. Check your own letter.

How do I know if I am affected by the Uber breach?

Look for a November 2026 Uber security incident letter. If you expect one and have none, call 1-866-317-7961.

Is Uber offering free credit monitoring?

Yes, through Cyberscout and MyTrueIdentity, with enrollment required within 90 days of the date on your letter.

What is the Uber breach enrollment deadline?

For a letter dated November 10, 2026, about February 8, 2027. Use the date on your letter.

Has stolen Uber driver information been misused?

Uber says it has found no misuse so far. That does not guarantee none will occur.

Can I get $750 from Uber for this data breach?

No payment has been announced. California law allows statutory damages of $107 to $799 in qualifying cases, but receiving a letter does not establish a claim.

Is there an Uber data breach settlement?

No settlement for this October 2026 incident has been verified as of November 14, 2026.

Will Uber replace my driver’s license?

No universal replacement program has been announced. If your license is being misused, contact your state licensing agency and Uber’s helpline.

Are former Uber drivers affected?

Possibly. Notice depends on the data accessed, not on whether you currently drive.

Official Uber Breach Contacts and Sources

Uber breach helpline: 1-866-317-7961, Monday to Friday, 8 a.m. to 8 p.m. Eastern Time, excluding holidays.

Mail: Uber Technologies, Inc., c/o Cyberscout, P.O. Box 3826, Suwanee, GA 30024

Bottom Line

Uber’s October 2026 breach exposed driver’s license information and other personal data through stolen credentials at its vendor, Fireworks AI. Letters are going out, but the nationwide number is unknown. If you get a notice, read which data was involved, enroll in the free protection within 90 days, freeze your credit and watch your accounts. No class action or settlement has been verified, and no cash payment is guaranteed. This page will be updated if a nationwide count, a court filing or new findings are confirmed.

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts verified against the California Attorney General’s Uber breach filing, Massachusetts and South Carolina state breach notices, Fireworks AI’s security bulletins, and TechCrunch’s November 13, 2026 reporting, as of November 14, 2026. Last Updated: November 14, 2026.

This article is for informational purposes only and does not constitute legal advice. Laws vary by state and individual circumstances differ. For advice about your specific situation, consult a qualified attorney.

About the Author

Israr Ahmad is a legal content researcher with 4+ years of experience covering class action settlements and consumer rights cases. He has researched and published coverage of 2,500+ settlements using verified court records, settlement administrator filings, and government sources. Learn more about Israr.