Uber is contacting thousands of drivers to inform them that personal information and driver's license data were stolen in an October breach at one of its technology providers, the company said in notices filed this week with several state attorneys general, including California. The ride-hail company said the provider alerted it on October 9 that hackers had broken in and taken internal credentials, which were then used to reach Uber's data. Uber said it has since begun telling affected drivers that their information was held by the provider.
The provider is Fireworks AI, which gives developers access to open AI models, according to TechCrunch. Fireworks disclosed a breach last month in which hackers took customer information, including billing data and some private AI datasets. Online productivity startup Notion has confirmed that its data was also stolen in the Fireworks hack.
An Uber spokesperson said the driver notices concern a security incident at third-party vendor Fireworks.ai, which had access to some Uber data, and referred questions to Fireworks. Uber did not disclose how many customers are affected or how many drivers it is notifying. A Fireworks spokesperson, reached by email, confirmed the company found a security issue involving unauthorized access to some of its systems that affected customer data, but did not address questions about the incident.
According to breach notices seen by TechCrunch, the stolen data includes driver's licenses belonging to 2,567 people in Massachusetts, 3,430 people across South Carolina and 1,873 residents of Rhode Island. A filing with Illinois indicated that some state residents had driver's license information stolen, but the number of affected people was pending. Uber also notified drivers in California without saying how many had information stolen. The total is expected to rise as more breach notifications arrive.
Fireworks has attributed its breach to a financially motivated cybercriminal group seeking to sell stolen tokens for accessing large language models. The incident is Uber's second known data breach this year; the company previously reported a security incident at its Uber Freight truck shipping unit, for which an extortion gang took credit for stealing data.
The disclosures place the incident within the growing set of US consumer data-protection obligations that require companies to notify state authorities and affected residents when personal information is compromised. For drivers, the stolen records include license information held by a vendor rather than by Uber itself, a detail the state filings make explicit.
More cybersecurity news from TechManNews.
