Thousands of Uber drivers have had their personal information compromised after hackers breached a third-party artificial intelligence startup utilized by the ride-hailing company. Uber recently submitted security breach notices to several state attorneys general to detail the incident, revealing that driver license numbers and other sensitive data were exposed in the attack. The breach stems from an incident at Fireworks AI, a startup that assists developers in accessing and utilizing open-source artificial intelligence models. According to official filings, Fireworks notified Uber on October 9 that unauthorized actors had stolen internal credentials to gain access to Uber's account with the provider. Uber subsequently determined on October 13 that the intruders had successfully accessed data belonging to its drivers.
While Uber has not publicly disclosed the exact nationwide total of impacted individuals, state-level filing notices shed light on the scope of the exposure. Notices submitted to regulatory bodies indicate that approximately 1,873 residents in Rhode Island, 3,430 residents in South Carolina, and 2,567 people in Massachusetts were affected, accumulating to at least 7,870 impacted individuals across just those three jurisdictions. Alongside Uber, productivity software platform Notion confirmed that customer data, including artificial intelligence chat transcripts, was also exposed during the Fireworks breach, impacting fewer than one percent of its total workspaces.
Key takeaways
- Hackers stole internal credentials from AI startup Fireworks AI to access Uber driver data.
- Compromised data includes driver license information across multiple states.
- Productivity app Notion also had customer AI chat transcripts exposed in the incident.
- Uber severed connections with Fireworks AI and is offering affected drivers free credit monitoring.
The Threat of LLMJacking and Third-Party Risk
Fireworks AI disclosed that the security incident involved hackers gaining access to development machines through a separate breach at one of its cloud providers. Following the initial compromise, Fireworks enlisted cybersecurity firm Palo Alto Networks and its Unit 42 division to perform a thorough forensic investigation. Investigators determined that the attack points toward a financially motivated cybercriminal syndicate engaging in a technique known as LLMJacking. This emerging cyber threat involves actors stealing credentials to access artificial intelligence models without authorization, allowing them to exploit the models for unauthorized tasks or sell access to third parties.
In response to the discovery, Uber moved quickly to sever all data connections linking its systems to Fireworks AI. Although Uber stated in its regulatory filing with the California Attorney General that it has found no evidence of the stolen information being misused thus far, the company is urging impacted drivers to monitor their credit histories and account statements closely for any unusual activity. To assist affected workers, Uber is providing complimentary credit monitoring and fraud resolution services through Cyberscout, with eligible drivers given a 90-day window from their notification date to enroll in the program.
Comments