What happened
Uber announced that it had suffered a data breach involving personal information and driver's license data of thousands of drivers on its platform in the United States. According to a report by IT之家, the incident involves drivers residing in Massachusetts, South Carolina, Rhode Island and Illinois, the four states cited in the company's communication.
The reconstructed sequence indicates that the unauthorized access originated at an external service provider: the perpetrators allegedly stole the login credentials of the provider's employees and, from there, reached Uber's systems and data. The company has initiated procedures to notify the affected drivers, informing them which information was exposed.
Partial figures and the company's caveats
The scale of the incident is only partly known. The figures reported cover three of the four states mentioned: 2,567 drivers in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island. For Illinois, the material does not provide a count, nor is the overall total number of people involved indicated.
Uber did not disclose the name of the third-party provider involved, nor did it quantify the number of passengers potentially affected by the data theft. At the time of publication, no cybercriminal group had claimed responsibility for the attack. These are therefore elements that remain to be clarified and that the company has not confirmed.
The role attributed to the provider and the earlier incident
The link to the specific provider does not come from Uber but from a journalistic reconstruction: according to what was reported by TechCrunch and taken up by the source, the provider involved would be Fireworks AI, a platform that offers developers services to run, optimize and scale open-source artificial intelligence models. This is an attribution reported by the press, not a statement by the company.
The source places the episode as Uber's second security incident in 2026. Previously, in August, the Helix ransomware group allegedly stole data from the Uber Freight division using social engineering techniques. The recurrence of incidents within a few months, through different routes — an external provider now, a company division then — is the point that emerges from comparing the two cases described.
