UBER CONFIRMS THOUSANDS OF DRIVERS LICENSE RECORDS STOLEN IN THIRD-PARTY BREACH
Uber has confirmed that hackers accessed personal information belonging to thousands of its U.S. drivers, including driver’s license details, after compromising credentials at a third-party technology vendor.
The vendor is Fireworks AI, a platform that provides developers access to open AI models. Fireworks notified Uber on October 9 that an unauthorized party had stolen internal credentials and used them to reach Uber’s account with the provider. Uber immediately cut its data connections with the vendor and launched an investigation. By October 13, the company determined that the intruders had accessed Uber data that included drivers’ personal information.
State filings show the scope of the exposure so far. Massachusetts reported 2,567 affected individuals. South Carolina listed 3,430. Rhode Island reported approximately 1,873. Combined, those three states alone account for at least 7,870 people. Illinois notified residents that some had their driver’s license information stolen, with the exact number still pending. California drivers were also notified, though no total was disclosed. Additional notices covered residents in the District of Columbia, Maryland, New York, North Carolina, and Pennsylvania.
An Uber spokesperson stated: “The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data.” In notification letters, Uber told affected drivers: “We promptly launched an investigation and severed our data connections with the service provider to prevent further unauthorized access to Uber data. We are providing you with access to credit monitoring and fraud assistance at no charge.” The company said it has found no evidence that the stolen data has been misused. Affected individuals are being offered free credit monitoring and fraud assistance through Cyberscout, a TransUnion company, with enrollment available for 90 days from the date of the notice.
Fireworks AI previously disclosed its own breach in October and later updated that customer account and billing information, along with some datasets and incomplete AI models, had been accessed. Notion has also confirmed that its data was involved in the same incident. The California breach database lists the incident date as October 7.
This marks the second known data breach involving Uber this year. The company has not released a nationwide total of affected drivers.