Uber has disclosed that the personal information and driver's licenses of thousands of its drivers were compromised in a data breach tied to one of its service providers. The company revealed the incident in a filing with several state attorneys general, which included the notices it sent to affected drivers. Uber said the service provider was hacked on October 9, and that the attackers stole internal credentials and then used them to reach Uber data connected to that provider.
Uber identified the third-party vendor as Fireworks.ai, a cloud platform that provides clients with access to open-source AI models. Fireworks has acknowledged that it suffered a data breach last month and that the incident compromised its clients' data. The company attributed the hack to attackers belonging to a cybercriminal group that sells stolen tokens used to access large language models.
It remains unclear whether the stolen information has been sold or leaked online. Neither Uber nor Fireworks.ai has disclosed how many drivers were affected overall.
According to TechCrunch, the driver's licenses of 3,430 people in South Carolina, 2,567 in Massachusetts and 1,873 in Rhode Island were exposed in the incident. Those figures point to affected drivers concentrated in three states, though the companies have not confirmed a total count.
The breach adds to the exposure of sensitive identity documents held by ride-hailing platforms, which collect driver's licenses as part of their onboarding and verification processes. For Uber drivers in the affected states, the compromised data includes license information rather than only account details.
Uber's disclosure came through filings with state attorneys general, the mechanism by which companies typically notify regulators and residents about breaches affecting personal data. The notices sent to drivers describe how the credentials stolen from Fireworks.ai were used to access Uber data linked to the vendor.
More cybersecurity news from TechManNews.
