This is a new development in a story we reported earlier: Fireworks AI discloses wider October breach as Notion confirms chat impact. Earlier in this story: Fireworks AI discloses second breach tied to compromised cloud provider.
Uber confirmed on Nov. 10 that hackers used compromised Fireworks AI credentials to steal driver’s license images and personal details from thousands of U.S. drivers. The company sent breach notices to U.S. state attorneys general and named Fireworks AI as the vendor involved. The compromised credentials belonged to Fireworks AI, a third-party AI vendor.
State filings counted 3,430 affected people in South Carolina, 2,567 in Massachusetts and 1,873 in Rhode Island. Uber also notified drivers in California without disclosing a count. An Illinois filing shows the number of affected residents is pending. California and Illinois have not published totals.
The company declined to provide the total number of affected customers. Uber also declined to provide the count of drivers receiving notices. Uber expects the total number of affected drivers to rise as more state filings are published.
On Oct. 9, Fireworks told Uber about the intrusion and issued its first security bulletin. Uber severed its data links with the vendor that day. Fireworks said a financially motivated cybercriminal group carried out the intrusion to sell access to large language models, a practice called LLMJacking. Fireworks’ notification preceded Uber’s public breach notices.
No group has publicly claimed the attack. Uber referred questions about the root cause to Fireworks. Fireworks provided the attribution and motive for the intrusion.
Notion confirmed that chat transcripts from Notion AI linked with the Insights feature were exposed during that same Fireworks incident. Fireworks also said customer information was exposed in its breach last month. The exposed information included billing data and certain private AI datasets. The breach last month was a prior Fireworks customer data exposure.
This is Uber’s second known security incident of 2026. Uber Freight disclosed an August security incident. In that incident, the Helix extortion group claimed to have stolen nearly 1 million files.
The August incident provides details of Uber’s earlier 2026 security event.
Join the discussion