Ride-hailing giant Uber is actively notifying thousands of drivers that their personal information and driver's license details were compromised in an October data breach. The security incident originated at one of the company's technology vendors, which has been identified as Fireworks AI. Notices filed across multiple U.S. states reveal that internal credentials stored by the vendor were stolen by hackers and subsequently used to access sensitive Uber data.
The breach first came to light when Fireworks AI notified Uber on October 9 about unauthorized access to its systems. Fireworks AI operates as a platform allowing developers to access and utilize open AI models. In addition to Uber's files, the platform's security incident also impacted other prominent tech companies, including online productivity startup Notion, which confirmed that its corporate data was similarly stolen during the cyberattack.
Key takeaways
- Uber reported an October data breach tied to its third-party tech vendor, Fireworks AI.
- Stolen records include thousands of driver's licenses across states like Massachusetts, South Carolina, and Rhode Island.
- Fireworks AI attributed the attack to financially motivated cybercriminals targeting large language model access tokens.
- This marks Uber's second reported security incident of the year, following an earlier breach at its Uber Freight division.
Scope of the Stolen Driver Information
State-level filings and official breach notices have begun mapping out the scale of the exposure for drivers. In Massachusetts, records confirm that the driver's licenses of 2,567 individuals were compromised. South Carolina reported 3,430 affected people, while Rhode Island filings account for 1,873 impacted residents. An Illinois filing noted that state residents had their driver's license data stolen, though the exact total remains pending.
Uber also filed notices for drivers residing in California, though the company initially withheld specific figures for that region. Representatives for Uber stated that the total count of affected individuals is likely to climb higher as additional state notifications are processed and released. Neither Uber nor Fireworks AI provided a definitive global tally of total affected customers or drivers, though affected drivers continue to receive direct warnings.
Vendor Attribution and Prior Incidents
Fireworks AI attributed the network intrusion to a financially motivated cybercriminal syndicate. According to the vendor, the primary objective of the threat actors was to steal and monetize access tokens associated with large language models, or LLMs. As of now, no specific cybercriminal group has publicly claimed responsibility for the data theft, and representatives for Fireworks confirmed the security issue without addressing further specific inquiries.
This development represents the second known cybersecurity incident faced by Uber this year. Earlier in the year, the company disclosed a separate security breach affecting its Uber Freight truck shipping division, an incident where an extortion gang claimed credit for stealing internal files. As regulatory filings continue to roll out across various U.S. states, impacted individuals are urged to monitor their accounts for potential misuse of their personal and driving credentials.
Comments