Hackers stole driver’s license data from thousands of Uber drivers in the United States after breaching Fireworks AI, a technology provider for the platform. Uber is notifying affected individuals; notices filed in several states have already identified thousands of residents, although the company has not disclosed a total.
Fireworks credentials opened access to Uber data
According to notices sent to state authorities and reviewed by TechCrunch, Fireworks informed Uber on October 9 that attackers had accessed its systems and stolen internal credentials. Those credentials were then used to access Uber data stored with the provider. The transportation company began notifying affected drivers.
Uber described the case as a security incident involving one of its third-party providers, Fireworks.ai, which had access to some of its data. The company did not specify how many drivers it is notifying or how many people were affected in total. The figure could rise as more breach notices are filed.
“prevent further unauthorized access to Uber data.”
— Uber, in the notice cited by The Hill
The Hill reported that Uber immediately cut off data connections with the provider to prevent further unauthorized access. In the company’s notice, dated November 10, Uber also said that, up to that point, it had not identified any misuse of the data.
State notices already add up to thousands of drivers
Documents reviewed by TechCrunch attribute the theft of driver’s license information to 2,567 people in Massachusetts, 3,430 in South Carolina, and 1,873 Rhode Island residents. A notice from Illinois confirms that residents were affected, but the number is still pending. Uber also notified drivers in California without making the number public.
The known state figures represent notices filed so far, not a definitive nationwide count. TechCrunch notes that the total is expected to grow as new notices are published. Uber has not provided an overall tally or said how many people have already received a direct notification.
There is also a discrepancy in how the stolen information is described: TechCrunch refers to driver’s license data, while The Hill attributes to that outlet a reference to license plate numbers. According to TechCrunch’s account, Uber’s notice includes driver’s licenses; no further clarification of this discrepancy is provided.
Fireworks AI also suffered theft of customer data
Fireworks AI is a platform that enables developers to access and use open AI models. The Hill says that, according to the company’s website, it is used by more than 10,000 companies worldwide, and its customers include Zillow, Samsung, and Notion, as well as Uber.
The Fireworks incident came to light the previous month. The company said at the time that attackers had stolen customer information, including billing data and some private AI datasets. Notion, a productivity app, confirmed that its data was also stolen in the attack.
A Fireworks spokesperson confirmed to TechCrunch that the company had detected a security issue involving unauthorized access to some of its systems and that customer data was affected. The spokesperson did not respond to the outlet’s specific questions about the incident. Uber referred questions about the provider to Fireworks.
The dates in the notices do not match
The notices described by TechCrunch place the date Fireworks alerted Uber on October 9. The Hill, by contrast, says that the California attorney general’s office received the breach notification on October 7, two days before the date Uber said it had been informed by the provider. The discrepancy appears in the records cited by both outlets and is not explained in their reports.
The Uber notice cited by The Hill is dated November 10. According to the outlet, the company is offering affected individuals free access to credit monitoring and fraud assistance services.
Uber’s second known incident of the year
The Fireworks-related breach is Uber’s second known data incident this year, according to TechCrunch. In another case, Uber reported a security issue at Uber Freight, its road freight transportation unit. An extortion group claimed responsibility for stealing data in that incident.
In the current case, Fireworks attributed the intrusion to a financially motivated cybercriminal group whose goal was allegedly to sell stolen tokens for accessing large language models. No known group has publicly claimed responsibility for stealing Uber’s data.
For now, Uber has not published the total number of affected drivers. The total is expected to rise as more notifications are issued; figures for Illinois and California remain incomplete.
Sources: OMG! Ubuntu, TechCrunch, The Hill via AOL
