Uber: driver personal data accessed via compromised credentials at a service provider (no CVE)
Severity: medium · Patch status: no-fix-needed · Since 2026-11-14
Uber's notice letter, dated 2026-11-10 and copied to the California Attorney General as a multistate template, says a service provider notified Uber on 2026-10-09 that an unauthorized party had compromised the provider's internal credentials and used them to access Uber's account with that provider. Uber's investigation, concluded on 2026-10-13, found the same party had used those credentials to access Uber data connected to the provider, and that the personal information of the people notified was among what was accessed. The letter does not name the provider and its data-elements field is an unfilled placeholder, so the kinds of data involved, including whether driver's license numbers were, are not confirmed by this notice. The Rhode Island addendum gives approximately 1,873 Rhode Island residents; no national total was found in the sources checked. Uber says it has identified no misuse to date and offers credit monitoring and fraud assistance through Cyberscout. Fireworks AI as the provider is reported only in a secondary headline that could not be read, and is not confirmed. No product patch applies; the remediation is provider credential control, scoping and monitoring of the affected people, and a root-cause report before data flows resume.
What to do
- Scope the service-provider credentials that reached Uber data and confirm they were rotated
- Confirm with Uber which data elements were involved, including whether driver's license numbers were; the notice template leaves that field unfilled
- Notify and support affected people: Uber's notice offers credit monitoring and fraud assistance through Cyberscout
- Limit third-party access to personal data and require provider access logging and credential expiry
- Wait for the provider's root-cause and containment report before restoring data flows
Sources
All live incidents on Threat Watch
