Uber data breach 2026: got a letter? Do these 4 things first

So far, the people getting letters are Uber drivers. Uber hasn’t said how many people in total were caught up in the incident, and it hasn’t said how many drivers it is contacting. Every filing made public so far is with a US state, so the picture for drivers in Canada and the UK is unclear; Uber hasn’t addressed it.

The data Uber confirms was exposed is driver’s license information. The letters describe it as personal information that was stored with the vendor. Uber hasn’t published a fuller list of fields, so read your own letter closely. It’s the only document that tells you what was taken about you specifically.

Nothing Uber has said so far mentions riders who have never driven for the company.

Here’s the timeline Uber gave regulators, in plain terms:

• October 7: someone outside the company got hold of the vendor’s internal credentials and used them to log in to Uber’s account with that vendor.
• October 9: the vendor spotted the activity and warned Uber.
• October 13: Uber’s investigation confirmed the intruder had accessed Uber data held with the vendor, including personal details.
• November 10: Uber started mailing letters to affected people.

An Uber spokesperson confirmed the letters relate to a security incident at Fireworks.ai, which had access to some Uber data.

Fireworks has had a rough autumn. It disclosed one incident in early October, when attackers got into environment variables holding API keys and tokens (the digital passes software uses to talk to other services) for a limited number of accounts. Fireworks linked that attack to a financially motivated criminal group that sells stolen access to large language models, a practice known as LLMjacking. Then, on October 23, a third-party cloud provider hosting Fireworks research machines was hacked, and the next day the intruders used it to run unauthorized work on those machines. That second break-in exposed customer billing details, some datasets and partial model weights.

Uber’s own dates point to the first of those two incidents, the one built on stolen internal credentials. Fireworks confirmed it found unauthorized access affecting customer data but didn’t answer detailed questions. No criminal group has publicly claimed the theft.

This is the part nobody has explained yet. Fireworks sells computing power for running AI models. Uber hasn’t said what it used Fireworks for, or why records tied to driver’s licenses were sitting where a vendor’s stolen login could reach them.

It matters beyond Uber. Companies are wiring more customer data into AI tools, often through outside providers you’ve never heard of. Notion, the note-taking app, has already said the same Fireworks attacks exposed some of its AI chat transcripts. Fewer than 1% of Notion workspaces were affected, Notion says, and it is telling customers to treat that data as exposed and to change any passwords or keys they pasted into its AI chat during the incident.

For Uber, this is the second known breach of 2026. Earlier in the year, its Uber Freight trucking unit reported a security incident, and an extortion gang took credit for stealing data there.

Do these four things, in this order:

1. Sign up for the free monitoring. Uber is paying for credit monitoring and fraud help from Cyberscout, which is part of TransUnion. Your letter has a unique activation code and the enrollment address. You must enroll within 90 days of the date printed on the letter, so don’t let it sit in a drawer.
2. Think about a credit freeze. A freeze stops lenders from pulling your credit report, so nobody can open new credit in your name, you included, until you lift it. It’s free at each of the three big credit bureaus. Online or phone requests must take effect within one business day, and lifting a freeze online takes no more than an hour, so it won’t block you for long when you need a loan.
3. Watch for warning signs. Look for bills for things you didn’t buy, collection calls about accounts you never opened, unfamiliar accounts on your credit report, or loan denials that make no sense.
4. Report anything odd fast. Contact the FTC through its identity theft site or at 1-877-438-4338, ask the credit bureaus for fraud alerts, and call the fraud departments of your bank and card issuers.

Questions about the letter itself go to Uber’s dedicated line at 1-866-317-7961, open 8 a.m. to 8 p.m. Eastern time, Monday through Friday, except holidays.

Big breaches attract copycat scams. The genuine notice from Uber arrives as a written letter, and the activation code inside it is what unlocks the monitoring service. Be wary of a text, call or email that claims to be about the breach and asks you to confirm your license number, Social Security number or bank details. Official advice is simple: don’t answer messages from numbers or people you don’t know, and don’t hand over personal details because someone asked.

If you’re unsure whether something is real, call the number printed on your paper letter rather than one given in a message.