Uber is telling thousands of its drivers that their personal information and driver’s license details were stolen in an October breach at one of its technology providers, according to breach notices the company filed this week with several state attorneys general, including California‘s.
The notice, dated Nov. 10, says the provider told Uber on Oct. 9 that an unauthorized party had compromised the provider’s internal credentials and used them to reach Uber’s account with the provider. Uber said it cut its data connections with the provider and opened an investigation.
By Oct. 13, that investigation had found the credentials were used to access Uber data connected to the provider, and that drivers’ personal information was among the data accessed, the notice says. The California filing lists Oct. 7 as the date of the breach.
Uber has not given a total for how many drivers were affected nationwide. Notices seen by TechCrunch put the figure at 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island — 7,870 across the three states — with an Illinois filing still showing the count as pending and California drivers notified without a public number.
The notice itself did not name the provider or list the data taken. TechCrunch reported that the provider was Fireworks AI and that the data included driver’s license information.
“The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data,”
What Fireworks has said
Fireworks runs a cloud platform that lets developers use open AI models. It confirmed to TechCrunch that it had found unauthorized access to some of its systems, with customer data affected, but it did not answer questions about the Uber incident. The company has attributed its breach to a financially motivated cybercriminal group that sells stolen tokens used to access large language models. No group has claimed credit for the theft.
In its own bulletins, Fireworks dates the first finding to Oct. 6, when it identified unauthorized use of its internal credentials. A first bulletin followed on Oct. 9. On Nov. 9 the company widened the picture: the update added account and billing information to the impact list and, for a limited set of accounts, secrets, datasets and incomplete models. It also described a second route in, in late October, through a cloud provider that hosted its research machines. Palo Alto Networks’ Unit 42 is handling forensic work for Fireworks, which says it has notified law enforcement.
Uber says it has found no sign, so far, that the stolen information has been misused. Affected drivers are being offered free credit monitoring and fraud assistance through Cyberscout, a TransUnion company, and have 90 days from the date of their letter to enroll.
Online productivity company Notion has also confirmed its data was stolen in the Fireworks hack, according to TechCrunch. For Uber, the incident is its second known data breach this year, after a security incident at its Uber Freight trucking unit.