Uber confirms hackers stole thousands of drivers' license records in data breach
Ride-hailing company Uber is notifying thousands of drivers that their personal and driver's license details were stolen in an October breach at a tech vendor. The vendor is AI platform Fireworks AI.
Uber, the U.S.-based ride-hailing platform, is telling thousands of its drivers that their personal data and driver's license details were stolen in a breach that hit one of its technology vendors in October. Notices were filed this week with several U.S. state attorneys general, including California's. According to information obtained by TechCrunch, the vendor is Fireworks AI, a company that lets developers access and use open AI models.
How the breach unfolded
Uber says the vendor alerted it on October 9 that hackers had broken in and stolen internal credentials, which were then used to reach Uber's data. The company then began notifying drivers whose information was stored with the vendor. An Uber spokesperson told TechCrunch the notices relate to a security incident at third-party vendor Fireworks.ai, which had access to some Uber data, and referred further questions to Fireworks.
Fireworks reported its own breach last month, in which hackers took customer information including billing data and some private AI datasets. Notion, an online productivity startup, has also confirmed that its data was stolen in the same attack. A Fireworks spokesperson did not respond to TechCrunch's questions.
Number of people affected
Uber did not say how many people overall are affected or how many drivers it is notifying. Breach notices show stolen driver's license data for 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 Rhode Island residents. An Illinois filing indicated that some residents were affected, but the number is still pending. Uber also notified drivers in California without saying how many were impacted. The count is expected to grow as more notifications are filed.
Fireworks blamed the breach on a financially motivated cybercriminal group that aims to sell stolen tokens used to access large language models (LLMs). No known group has claimed responsibility for the theft.
It is Uber's second known data breach this year. The company previously reported a security incident at its Uber Freight trucking unit, for which an extortion gang claimed it had stolen data.
