Uber tells drivers hackers swiped license data from vendor Fireworks AI

Uber started alerting drivers after the provider told the company on October 9 that hackers had broken in and stolen internal credentials, which were then used to reach Uber's data, according to notices filed this week with several U.S. attorneys general, including California. Uber said the affected drivers' personal information was stored with that provider.

TechCrunch has learned the provider is Fireworks AI, which gives developers access to open AI models. Fireworks reported its own breach last month, saying hackers stole customer information including billing data and some private AI datasets. Online productivity startup Notion confirmed its data was also taken in the Fireworks hack.

Uber declined to say how many drivers it is notifying or how many are affected overall, and a Fireworks spokesperson didn't answer questions about the incident. Uber's spokesperson tied the notices to a security incident at the third-party vendor, which had access to some Uber data, and pointed further questions to Fireworks.

The numbers so far, from breach notices seen by TechCrunch: driver's licenses belonging to 2,567 people in Massachusetts, 3,430 people across South Carolina and 1,873 Rhode Island residents. An Illinois filing said some residents' license information was stolen but left the figure pending. Uber also notified drivers in California without giving a count.

Fireworks blamed its breach on a financially motivated cybercriminal group that sells stolen tokens for accessing large language models. No known cybercriminal group has claimed credit for the theft. It's Uber's second known breach this year: the company previously reported a security incident at its Uber Freight truck shipping unit, which an extortion gang took credit for.