Uber breach exposes driver license data via Fireworks AI vendor

Personal identification records for thousands of ride-hail operators have been compromised following a security incident at a third-party technology vendor. Uber confirmed this week that it is alerting affected drivers after hackers accessed internal credentials through its provider, Fireworks AI, during an attack in October.

Breach mechanics and vendor role

The ride-hailing giant received notification from the provider on October 9 regarding unauthorized access to its systems. According to filings with multiple U.S. attorneys general, including California’s office, the intruders stole internal credentials which they subsequently used to retrieve Uber’s stored data. The company stated that it began contacting impacted drivers once it determined their personal information was held by the vendor.

TechCrunch identified the breached entity as Fireworks AI, a platform enabling developers to utilize open artificial intelligence models. The startup disclosed last month that attackers had exfiltrated customer information, including billing details and private datasets. Online productivity service Notion also confirmed its data was taken during the same incident.

Affected states and data scope

An Uber spokesperson told TechCrunch that the notifications relate to a security event affecting Fireworks.ai, which had access to some Uber data, while directing further inquiries to the vendor. A representative for Fireworks did not respond to requests for comment. Uber has not disclosed the total number of customers or drivers impacted by the breach.

Data breach notices reviewed by TechCrunch specify that driver’s license information for 2,567 individuals in Massachusetts, 3,430 people in South Carolina, and 1,873 residents of Rhode Island was stolen. An Illinois filing indicated that state residents’ license data was also compromised, though the exact count remained pending. Drivers in California received notifications without specific figures on how many had their information exposed. Authorities expect these numbers to increase as additional state-level reports emerge.

Criminal attribution and history

Fireworks attributed the intrusion to a financially motivated cybercriminal group aiming to sell stolen tokens used for accessing large language models (LLMs). No known criminal organization has claimed responsibility for the theft. This marks the second significant data breach for Uber this year; the company previously reported a security incident at its Uber Freight unit, where an extortion gang took credit for stealing data.