Uber Confirms Vendor Breach Exposed Drivers' License Data
Uber is notifying thousands of drivers that their personal details and driver's license numbers were stolen during an October breach at a third-party technology vendor, TechCrunch and Crypto Briefing reported. According to filings with several US state attorneys general, including California, unauthorized access began as early as October 7, the vendor alerted Uber on October 9, Uber confirmed the breach on October 13, and driver notifications started on November 10, Crypto Briefing reported. TechCrunch identified the vendor as Fireworks AI, a platform that lets developers run open AI models and had suffered a breach last month exposing customer billing data and private AI datasets.
Affected States and Vendor Response
"The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data," an Uber spokesperson told TechCrunch while referring questions to Fireworks. State breach filings reviewed by TechCrunch show driver's license data was stolen from 3,430 residents in South Carolina, 2,567 in Massachusetts, and 1,873 in Rhode Island, alongside an unquantified number of Illinois and California drivers. Crypto Briefing reported that Uber said it has cut ties with the vendor, has seen no known misuse of the stolen data, and is offering affected drivers free credit monitoring and fraud assistance through TransUnion. A San Francisco jury found former Uber security chief Joe Sullivan guilty of failing to report Uber's 2016 data breach to authorities, according to Arc.dev.
According to TechCrunch, online productivity startup Notion also confirmed its data was stolen in the Fireworks hack, while Fireworks attributed its breach to a financially motivated cybercriminal group aiming to sell stolen LLM access tokens. Neither Uber nor Fireworks disclosed the total number of affected drivers or customers, and no cybercriminal group has claimed credit for stealing the Uber data, TechCrunch reported. TechCrunch noted this is Uber's second known breach this year after an earlier security incident at its Uber Freight unit.