Uber has confirmed that hackers stole the personal information and driver's license details of thousands of its drivers in a data breach at one of its technology providers, the ride-hailing company said in breach notices filed this week with state attorneys general.
The provider is Fireworks AI, a company that gives developers access to and lets them run open-source artificial intelligence models. TechCrunch, which first identified the vendor, reported that the stolen data includes driver's license information. An Uber spokesperson confirmed to TechCrunch that the notices "are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data."
Fireworks told Uber on October 9 that hackers had broken in and stolen its internal credentials and used them to reach Uber's data. Uber cut its data connections with the provider and opened an investigation, which confirmed on October 13 that the attackers had accessed Uber data, including drivers' personal information. Uber's notification letters to affected drivers are dated November 10, and the California attorney general's notice lists October 7 as the incident date.
Notices reviewed by TechCrunch list 2,567 affected people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island, or at least 7,870 drivers across those three states. Filings have also been made in Illinois, California, the District of Columbia, Maryland, North Carolina, New York and Pennsylvania, with some counts still pending, so the total is expected to rise. Uber has not disclosed a nationwide total or said how many passengers, if any, are affected; the notices seen so far concern drivers.
Fireworks disclosed its own breach in October and said hackers had accessed customer account and billing information, as well as datasets and incomplete AI models belonging to a limited number of accounts. The company said payment card numbers are not stored on its systems and were not affected. It attributed the intrusion to a financially motivated cybercriminal group seeking to sell stolen access tokens for large language models, a practice known as LLMJacking, and said it notified law enforcement and is working with cybersecurity firm Palo Alto Networks' Unit 42. No group has claimed responsibility for the theft.
Productivity startup Notion confirmed that its data was also stolen in the same Fireworks incident, with AI chat transcripts from fewer than 1 percent of its workspaces exposed.
Uber said it has found no evidence that the stolen information has been misused so far. Affected drivers are being offered free credit monitoring and fraud assistance through Cyberscout, a TransUnion company, and must enroll within 90 days of the date on their notification letter.
The disclosure came in a week already marked by major technology failures, including Microsoft's global outage, which disrupted Outlook, Teams and Copilot, and a Workday outage that locked employees out of payroll and human resources systems.
