Uber is notifying thousands of drivers in the United States that their personal information and driver’s license details were stolen in a data breach at one of its technology providers.
The provider is Fireworks AI, a company that lets developers access and use open artificial intelligence models. Fireworks told Uber on 9 October that hackers had broken into its systems and stolen internal credentials, which were then used to access Uber’s data. Uber’s investigation confirmed by 13 October that driver data had been accessed.
State filings show that the stolen data includes the driver’s licenses of 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island — a total of 7,870 across those three states. A filing in Illinois showed that some residents’ license data was also stolen, although the number there is still pending, and Uber has also notified drivers in California without stating how many. The total is expected to rise as more breach notifications are filed, and Uber has not said how many drivers it is notifying overall.
Fireworks reported its own breach last month, saying hackers stole customer information including billing data and some private AI datasets. Productivity startup Notion has also confirmed that its data was stolen in the Fireworks hack.
Fireworks attributed its breach to a financially motivated cybercriminal group whose goal is to sell stolen tokens for accessing large language models (LLMs). No known group has taken credit for the attack.
Uber is offering affected drivers free credit monitoring and fraud assistance through Cyberscout.
This is Uber’s second known data breach this year, following an earlier security incident at its Uber Freight truck-shipping unit.
The featured image is illustrative only and is not a photo of the data breach.
Source: TechCrunch
