Uber confirms data breach through a service provider

Attackers accessed Uber's personal data through an external service provider. Uber disclosed the breach in a letter to affected individuals dated 10 November 2026. Uber named Fireworks AI to TechCrunch.

Attackers used the provider's credentials

The attackers used the provider's internal credentials to access Uber's account there. After the provider alerted Uber, the company disconnected data connections and began investigating.

4,296 people affected in Texas

The Texas Attorney General's register lists 4,296 affected residents of the state. The entry, published on 13 November, lists names, addresses, dates of birth, driver's licence numbers and other government-issued ID numbers among the affected data. Uber notifies people by postal mail and email.

Fireworks revokes credentials and investigates the attack

Fireworks has revoked and replaced credentials and service accounts. The provider has also removed unnecessary access privileges and restricted access to its data storage. Fireworks is working with Palo Alto Networks Unit 42 on the investigation.

Fireworks contacts affected customers directly with details of the data involved and the steps it recommends. Our guide to compromised AI API keys explains how businesses can revoke stolen tokens and check affected accounts.

As of 14 November 2026.