THE CRUNCH
Uber is notifying thousands of drivers that hackers stole their personal and driver's licence information in an October breach at one of the company's technology providers. In filings with several U.S. attorneys general, Uber said it learned on October 9 that attackers had stolen internal credentials from the provider and used them to reach Uber's data. The provider has been identified as Fireworks AI, a company that lets developers use open AI models and which disclosed its own breach last month.
The stolen data includes driver's licence details for 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island, according to the breach notices. Drivers in California and Illinois were also notified, but Uber has not said how many were affected in those states, and an Illinois filing listed the affected count as pending. The total is expected to rise as more notifications come in.
The incident highlights how a breach at one supplier can ripple across its customer base: Fireworks said last month that hackers stole its customers' information, including billing data and some private AI datasets, and Notion has confirmed its data was also taken in the same attack. Fireworks attributed the breach to a financially motivated cybercriminal group that sells stolen tokens for accessing large language models, though no group has claimed credit for the data theft.
An Uber spokesperson confirmed the notices relate to a security incident at Fireworks, which had access to some Uber data, and deferred questions to Fireworks. A Fireworks spokesperson acknowledged unauthorised access to some of its systems affecting customer data but did not answer further questions. Neither company has said how many drivers in total are affected. It is Uber's second known breach this year, after a security incident at its Uber Freight unit that an extortion gang took credit for.