Uber is notifying thousands of its drivers in the United States that hackers stole their personal information, including driving licence details, after breaking into one of its technology suppliers.
The breach did not hit Uber’s own systems. It ran through Fireworks AI, a cloud platform that gives developers access to open-source artificial intelligence models. Fireworks told Uber on 9 October that attackers had stolen its internal credentials and used them to reach Uber’s account with the provider. By 13 October, Uber’s investigation had confirmed that the intruders accessed Uber data held with the vendor.
State filings reviewed by TechCrunch put the confirmed number at at least 7,870 drivers across three states: 3,430 in South Carolina, 2,567 in Massachusetts and 1,873 in Rhode Island. Drivers in California, Illinois, New York, Maryland, North Carolina and Washington DC have also been notified, but no counts have been given for those places, and the national total is not yet known. Uber began sending notification letters on 10 November.
Fireworks has attributed the attack to a financially motivated cybercriminal group involved in a practice it calls “LLMJacking”: stealing access tokens for large language models and selling them on. The company said the group was after money, not Uber’s data as such. No group has publicly claimed responsibility, and the attribution rests on Fireworks’ own account. It is not known whether the stolen driver data was sold or leaked online.
The incident is part of a wider breach at Fireworks that the company first disclosed in October. In an update on 9 November it said hackers had reached customer account and billing information, and, for a limited number of accounts, private datasets and incomplete AI models. Other customers were affected too: Notion has confirmed that AI chat transcripts from fewer than 1 per cent of its workspaces were exposed in the same incident.
Uber says it cut its data connections with Fireworks as soon as it learned of the breach, and that it has found no evidence the stolen information has been misused so far. Affected drivers are being offered free credit monitoring and fraud assistance through Cyberscout, a TransUnion company, if they enrol within 90 days of the date on their letter.
The episode underlines how much sensitive data now sits with AI suppliers. Driver licence details are the kind of government-issued identity information that can be used for fraud, and Uber has not explained why that data was held by a vendor whose business is running AI models. For drivers, the practical risk is identity theft; for the wider industry, the breach is a reminder that a supplier’s security is only as strong as its weakest credential.
Sources: TechCrunch (as reported by Engadget, https://www.engadget.com/2316881/uber-drivers-information-stolen-in-a-third-party-hack/, and Gizmodo, https://gizmodo.com/hackers-stole-thousands-of-uber-drivers-data-through-an-ai-startup-2000839947); Reuters, on Uber’s breach notice filed with the California attorney general; Fireworks AI security bulletins.
