Uber is notifying thousands of drivers that their personal information and driver’s license data were stolen during a security incident involving one of the company’s technology providers. The breach occurred in October, and the ride-hailing giant began sending notices to affected individuals this week.
According to data breach notices filed with several U.S. state attorneys general, including those in California, Massachusetts, South Carolina, and Rhode Island, the company was alerted to the intrusion on October 9. The notification came from the third-party vendor, which had been compromised by hackers who stole internal credentials. These credentials were then used to access Uber’s data.
Fireworks AI Security Incident
The provider involved in the breach is Fireworks AI, a platform that allows developers to access and use open artificial intelligence models. The company reported a separate data breach last month, during which hackers stole customer information, including billing data and some private AI datasets. Online productivity startup Notion also confirmed that its data was stolen in the same Fireworks hack.
An Uber spokesperson confirmed the connection to the vendor in a statement to TechCrunch. “The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data,” the spokesperson said. The company deferred further questions about the specifics of the incident to Fireworks.
A spokesperson for Fireworks confirmed that the company identified a security issue involving unauthorized access to some of its systems, which affected customer data. However, the spokesperson did not address specific questions about the incident or the extent of the data theft.
Driver License Information Stolen
Data breach notices reviewed by TechCrunch reveal the specific scope of the stolen driver’s license information. The breach affected 2,567 individuals in Massachusetts, 3,430 people across South Carolina, and 1,873 residents of Rhode Island. A filing with the state of Illinois indicated that some residents had their driver’s license information stolen, but the exact number of affected individuals was pending at the time of the report.
Uber also notified drivers who live in California, but did not disclose how many had their information stolen. The total number of affected drivers is expected to rise as more data breach notifications are filed in other states.
Fireworks attributed its breach to a financially motivated cybercriminal group. The group’s primary goal is to sell stolen tokens that provide access to large language models, or LLMs. No known cybercriminal group has publicly taken credit for the data theft from Uber’s systems.
Uber did not specify the total number of customers affected by this breach, nor did it state the total number of drivers being notified. The company has faced other security challenges recently. The firm reported a separate security incident at its Uber Freight truck shipping unit earlier this year, for which an extortion gang claimed responsibility for stealing data.
Source: TechCrunch
