Wire flash
Uber confirms driver's license data stolen via third-party provider Fireworks AI breach
Editorial responsibility
- No named human review is recorded for this page.
- Source reporting is collected, normalized, translated or condensed automatically when needed.
- Automatically published source-backed update
Uber is notifying thousands of drivers that their personal and driver's license information was stolen in an October data breach at a third-party technology provider, which TechCrunch identified as Fireworks AI. In notices filed with several U.S. attorneys general, including California, Uber said the provider alerted it on October 9 that hackers had stolen internal credentials used to access Uber data. Fireworks AI, which provides access to open AI models, reported a breach last month in which customer information including billing data and private AI datasets was stolen; Notion also confirmed its data was affected. Breach notices seen by TechCrunch show 2,567 individuals affected in Massachusetts, 3,430 in South Carolina, and 1,873 in Rhode Island, with Illinois and California counts pending, and the total is expected to rise. Fireworks attributed its breach to a financially motivated cybercriminal group seeking to sell stolen tokens for accessing large language models; no group has claimed credit. This is Uber's second known breach this year, following an incident at its Uber Freight unit.
Source report
Uber is notifying thousands of drivers that their personal and driver's license information was stolen during an October data breach at one of the company's tech providers.
Breach Details
In notices filed this week with several U.S. attorneys general, including California, the ride-hail giant said it was notified on October 9 by the provider that hackers broke in and stole internal credentials, which were used to access Uber's data. The company said it subsequently began notifying affected drivers that their personal information was stored with the provider.
TechCrunch has learned that the provider is Fireworks AI, which lets developers access and use open AI models. Fireworks reported a data breach last month in which hackers stole its customers' information, including billing data and some private AI datasets. Online productivity startup Notion confirmed its data was also stolen in the Fireworks hack.
Company Statements
"The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data," an Uber spokesperson told TechCrunch, deferring questions to Fireworks.
Uber did not say how many customers are affected by the breach, nor how many drivers it was notifying about the incident.
When reached by email, a spokesperson for Fireworks confirmed that the company identified a security issue involving unauthorized access to some of its systems, which affected customer data, but the spokesperson did not address questions about the incident.
Affected Individuals
According to data breach notices seen by TechCrunch, the stolen data includes driver's licenses of:
- 2,567 individuals in Massachusetts
- 3,430 people across South Carolina
- 1,873 residents of Rhode Island
A filing with Illinois showed that some state residents had their driver's license information stolen, but the number of affected people was pending. Uber also notified drivers who live in California, but did not say how many had their information stolen.
The number is expected to rise as more data breach notifications roll in.
Attribution
Fireworks attributed its breach to a financially motivated cybercriminal group whose goals are to sell stolen tokens for accessing large language models, or LLMs. No known cybercriminal group has taken credit for the data theft.
Second Breach This Year
This is Uber's second known data breach this year. The company reported a security incident at its Uber Freight truck shipping unit, for which an extortion gang took credit for stealing data.
Updated with a response from Fireworks.
Source
TechCrunchNeutral / independent