Uber confirms hackers stole thousands of drivers’ license information in data breach

Uber is notifying thousands of drivers that their personal and driver’s license information was stolen during an October data breach at one of the company’s tech providers.

In notices filed this week with several U.S. attorneys general, including California, the ride-hail giant said it was notified on October 9 by the provider that hackers broke in and stole internal credentials, which were used to access Uber’s data.

The company said it subsequently began notifying affected drivers that their personal information was stored with the provider.

TechCrunch has learned that the provider is Fireworks AI, which lets developers access and use open AI models. Fireworks reported a data breach last month in which hackers stole its customers’ information, including billing data and some private AI datasets.

Online productivity startup Notion confirmed its data was also stolen in the Fireworks hack.

“The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data,” an Uber spokesperson told TechCrunch, deferring our questions to Fireworks.

Uber did not say how many customers are affected by the breach, nor how many drivers it was notifying about the incident. A spokesperson for Fireworks did not respond to questions about the incident.

According to data breach notices seen by TechCrunch, the stolen data includes driver’s licenses of 2,567 individuals in Massachusetts, 3,430 people across South Carolina, and 1,873 residents of Rhode Island. A filing with Illinois showed that some state residents had their driver’s license information stolen, but that the number of affected people was pending. Uber also notified drivers who live in California, but did not say how many had their information stolen.

The number is expected to rise as more data breach notifications roll in.

Fireworks attributed its breach to a financially motivated cybercriminal group whose goals are to sell stolen tokens for accessing large language models, or LLMs.

No known cybercriminal group has taken credit for the data theft.