The key facts

  • The breach of vendor Fireworks AI occurred in October; Uber learned of the incident on October 9
  • Driver's license data was stolen: 2,567 people in Massachusetts, 3,430 in South Carolina, 1,873 in Rhode Island
  • The total number of affected individuals is unknown and is likely to grow; this is Uber's second known incident this year

What happened

Uber is sending notifications to thousands of drivers whose personal data and driver's license data were stolen in a hack of one of the company's technology vendors in October. In notifications filed with the attorneys general of several US states, including California, the company said that on October 9 the vendor informed it of the breach: attackers stole internal credentials and used them to access Uber's data.

The vendor involved and the scale

The vendor through which the leak occurred is Fireworks AI — a company that gives developers access to open AI models. It had previously reported a breach in which customer data was stolen, including billing information and part of its private AI datasets; Notion also confirmed the theft of its data. An Uber representative confirmed that the notifications to drivers are related to an incident at the third-party contractor Fireworks.ai, which had access to part of the company's data, and redirected questions to Fireworks; a Fireworks representative did not respond to requests.

Who was affected and what remains unknown

According to the breach notifications, the driver's license data of 2,567 people in Massachusetts, 3,430 people in South Carolina, and 1,873 residents of Rhode Island was stolen. In Illinois, the number of affected residents is still being tallied. Uber also notified drivers in California but did not state their number. The company has not disclosed either the total number of affected customers or the number of drivers being notified; the figures are expected to grow as new notifications come in.

Who was behind the attack

Fireworks linked the breach to a financially motivated cybercriminal group that sells stolen access tokens to large language models. No known group has claimed responsibility for the data theft. This is already Uber's second known data incident this year: earlier, the company reported a security breach in its freight division, Uber Freight, behind which was a gang of extortionists.