Hackers Stole Thousands of Uber Drivers’ Licence Details in AI Vendor Breach

Uber is notifying thousands of drivers in the United States that their personal information, including driving licence details, was stolen in a breach at one of its technology suppliers, the company has confirmed.

The intrusion came through Fireworks AI, a company that gives developers access to open-source artificial intelligence models. Uber said the supplier told it on 9 October that hackers had broken in using stolen internal credentials and used them to reach data Uber stored with the vendor. An Uber spokesperson confirmed the connection, saying: “The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data.”

TechCrunch reported the identity of the vendor on Friday, after Uber filed breach notices with attorneys general in several US states.

How the breach unfolded

Fireworks first flagged the problem on 9 October, when it told Uber that credentials had been compromised and used to access Uber’s account with the provider. Uber cut its data connections with the supplier and opened an investigation. By 13 October, the inquiry had established that the intruders had reached Uber data and that recipients’ personal information was among it.

Formal notices to drivers, dated 10 November, were filed this week with attorneys general in several states, including California. Reuters reported the filings on Friday, noting that Uber’s own notice did not name the provider or list the data involved.

Nearly 7,900 drivers named so far

State filings seen by TechCrunch list driving licence data stolen for 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island — 7,870 in total across those three states alone.

Notices have also gone to drivers in California, Illinois, the District of Columbia, Maryland, North Carolina, New York and Pennsylvania, with some state counts still pending. Uber has not given a national total, so the final figure is likely to rise as further filings appear.

The vendor at the centre of the attack

Fireworks AI hosts open AI models that developers can build on, and the attackers appear to have been after more than driver records. Fireworks has said the group behind the intrusion was financially motivated and aimed to sell stolen tokens that grant access to large language models, the systems behind chatbots such as ChatGPT. No cybercriminal group has publicly claimed responsibility.

The company has said the hackers also took customer billing information and some private AI datasets. The incident was not limited to Uber: online productivity firm Notion has confirmed that its data was also taken in the Fireworks intrusion, affecting fewer than 1% of its workspaces.

What Uber is offering drivers

Uber is offering affected drivers free credit monitoring and fraud assistance through Cyberscout, a TransUnion company. The company said it had not identified any misuse of the stolen data to date.

Driving licence details are prized by identity thieves because they can be used to pass checks, open accounts and impersonate victims. Drivers who receive a notice are being told to follow the instructions in the letter and to watch for signs that their identity is being misused.

A familiar problem for Uber

The episode underlines a widening risk for large technology companies: sensitive data is increasingly held by specialist AI suppliers, and a break-in at one vendor can expose the customers of many firms at once. The incident comes as companies pour money into AI security, with security firms racing to protect the systems that now sit at the centre of corporate operations.

It is also not the first breach notice to land this month — an earlier password manager breach forced users to reset their passwords after an encrypted database was stolen.

Uber has been here before. In 2016, hackers stole data on 57 million riders and drivers; the company later paid $148 million to settle with US states after it emerged that it had concealed the breach for a year. US authorities recently won court approval to seize $1.2 billion in crypto stolen from Binance, in a separate case that also traced stolen funds to North Korean hackers.

Uber has not said when the notification process will be complete, and the full scale of the Fireworks breach is still emerging as state filings continue to appear.