Uber reports vendor-linked data breach affecting drivers

Uber reports vendor-linked data breach involving drivers' information

New Delhi, Nov 14

The breach involved an unauthorised party gaining access to the vendor's internal credentials and using them to access Uber-related data, multiple reports said.

Uber came to the knowledge of the incident on October 9, 2026, following which it severed data connections with Fireworks AI and launched an investigation into the extent of the exposure. The company informed that it notified drivers about the security incident impacting its third-party vendor, Fireworks.ai.

The investigation found that the stolen credentials had been used to access Uber-related information, including sensitive personal data such as US driver's licence details.

Uber has not disclosed the total number of people affected by the data breach.

However, notifications submitted to authorities in several US states, including Massachusetts, South Carolina and Rhode Island, reveal that thousands of individuals may have been impacted. An official notification indicated that the security incident affected nearly 1,873 individuals in Rhode Island, with supplementary notices sent to residents in Washington and five other states.

The ride-hailing company said affected individuals are being offered 90 days of complimentary credit monitoring and fraud assistance through Cyberscout, a TransUnion company. Eligible recipients must enrol in the programme within 90 days of receiving notification letters.

The company has also indicated that it has found no evidence to ascertain that the exposed information has been misused.

The company in July had reduced nearly 10 per cent of its customer service workforce as the ride-hailing company reshaped its operations around artificial intelligence (AI) and a leaner organisational structure. The latest job cuts affected employees in Uber's community operations division, which handles customer support.

— IANS