Photo: Shutterstock Ride-hailing giant Uber confirms a serious data security breach, in which hackers managed to gain access to sensitive personal information of thousands of drivers in the United States, including driver's license details.
Details of the incident are now being revealed, after the company began notifying victims of the information disclosure, following a breach into the systems of an external artificial intelligence technology provider that worked with Uber.
According to the information released, the attackers did not need to directly hack into Uber's core systems. Instead, they exploited login details that were exposed at the service provider Fireworks AI, which allowed them to gain access to Uber's account with the provider and the information stored therein.
According to notifications filed with authorities in the United States, at least 7,870 people in three countries are included in reports of the security incident.
In Massachusetts, 2,567 casualties were reported, in South Carolina 3,430, and in Rhode Island another 1,873.
However, this data covers only three states. Uber also sent additional notifications in other countries, and It has not yet released the total number of casualties across the United States.
The information exposed also includes driver's license details, sensitive personal information that could be used for impersonation and identity theft attempts.
At this time, there is no confirmation that any Uber user accounts or passenger information were exposed as part of the incident.
According to the company's announcement, on October 9, 2026, Uber received a report from the service provider that an unauthorized party obtained internal login information.
Using these details, the attacker accessed Uber's account with the provider, gaining access to personal information stored outside the company's systems.
Uber said that immediately after receiving the report, it disconnected its data connections to the provider and launched an investigation.
On October 13, the investigation confirmed that the attacker had indeed accessed Uber information, including the personal information of people currently included in the breach announcements.
The notification letters to the victims are dated November 10, and details about the scope of the exposure have been published in recent days.
The incident raises questions about the security of personal information held by external technology providers, especially when it comes to companies that operate artificial intelligence infrastructures for large organizations.
In this case, the point of entry was at the service provider and not in Uber's core systems, but it allowed the attackers to access information related to the company's drivers.
In its official statement, Uber said that as of the date the notices were sent, no misuse of the disclosed information had been identified.
The company offers victims credit monitoring services and assistance in cases of fraud through Cyberscout, a TransUnion company, free of charge.
Affected drivers are asked to register for the service within 90 days of the date of the notification letter they received.
At the same time, victims are advised to monitor unusual activity in their accounts and consider activating additional protection measures against identity theft.
Currently, Uber has not yet provided a comprehensive figure on the number of drivers affected across the United States.