Uber says hackers stole driver's license data for thousands of drivers
A breach at an AI vendor Uber relies on exposed drivers' personal details across several states, and the final count is still climbing.
What happened: Uber has begun notifying thousands of drivers that hackers stole their personal information, including driver's license details, in an October breach. The intrusion didn't start inside Uber's own systems but at Fireworks AI, a third-party vendor that gives developers access to open AI models and that had access to some Uber data. Fireworks told Uber on October 9 that attackers used stolen internal credentials to break in, and that the same intrusion hit other Fireworks customers too, including workplace software company Notion. Uber has filed breach notices with attorneys general in several states, including California, Massachusetts, South Carolina, Rhode Island and Illinois, but hasn't said how many drivers overall are affected.
Why it matters: Driver's license numbers are exactly what identity thieves want, since they can be used to open accounts, apply for loans or impersonate someone during a traffic stop. For gig workers who already hand sensitive documents to multiple apps just to keep working, this adds risk they didn't choose and largely can't avoid, since they have no direct relationship with Fireworks, the vendor that was actually hacked. It's also Uber's second known breach this year, after an extortion gang claimed to have stolen data from its freight trucking unit, raising questions about how much driver and shipment data sits with outside tech partners.
How it works, plainly: Uber doesn't run every piece of its tech stack itself. Fireworks AI hosts and serves open AI models for developers, and Uber used it to process some internal data. When Fireworks was hacked, attackers reportedly stole internal credentials and used them to pull customer data, which Fireworks says included billing details and some private AI datasets. Because Uber had shared driver information with Fireworks for its own business purposes, that data went out the door along with everything else. Fireworks blames a financially motivated group it says wants to resell stolen access tokens for large language models, though no one has publicly claimed the theft.
The rollout: State filings show the scale growing piecemeal: 2,567 affected drivers in Massachusetts, 3,430 in South Carolina, 1,873 in Rhode Island, an unspecified number in California, and a count still pending in Illinois. Uber says more notifications are coming as additional states and drivers are confirmed, meaning the real total is likely higher than what's public now. Neither Uber nor Fireworks has detailed what protections, such as credit monitoring, are being offered to affected drivers, and Fireworks hasn't answered specific questions about how the intrusion happened.