Uber confirms hackers stole thousands of drivers' licenses in breach

Uber is notifying thousands of drivers that hackers stole their personal information and driver's license data during an October breach at one of its technology providers. Filings this week with several U.S. attorneys general, including California, put hard numbers on the damage: 2,567 affected individuals in Massachusetts, 3,430 in South Carolina, and 1,873 in Rhode Island.

The ride-hail giant said its provider notified it on October 9 that hackers had broken in and stolen internal credentials, which they then used to access Uber's data. Uber subsequently began telling affected drivers that their personal information was stored with the provider.

Who is the vendor behind the breach?

TechCrunch identified the provider as Fireworks AI, a platform that lets developers access and use open AI models. Fireworks reported a data breach last month in which hackers stole its customers' information, including billing data and some private AI datasets. Online productivity startup Notion also confirmed its data was stolen in the same Fireworks hack — meaning Uber is one of at least two well-known customers caught in the fallout.

"The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data," an Uber spokesperson told TechCrunch. The company deferred further questions to Fireworks.

That deflection didn't produce answers. A spokesperson for Fireworks did not respond to questions about the incident.

How many drivers are affected?

Uber won't say. The company did not disclose how many customers the breach affects, nor how many drivers it is notifying. But the state-level filings, seen by TechCrunch, sketch the scope:

• Massachusetts: driver's licenses of 2,567 individuals
• South Carolina: 3,430 people
• Rhode Island: 1,873 residents
• Illinois: some residents affected, exact number pending
• California: drivers notified, count not disclosed

The tally is expected to rise as more data breach notifications roll in.

What do the attackers want?

Fireworks attributed its breach to a financially motivated cybercriminal group whose goals are to sell stolen tokens for accessing large language models. That motive matters: it suggests the attackers were hunting for LLM access credentials and payment data, with driver's license records surfacing as collateral in the stolen haul. No known cybercriminal group has taken credit for the data theft.

For Uber, the reputational math is worse than a single incident suggests. This is the company's second known data breach this year. Uber previously reported a security incident at its Uber Freight truck shipping unit, for which an extortion gang took credit for stealing data.

The pattern — two breaches in one year, both tied to data accessible outside Uber's own walls — points to a persistent weakness in vendor-side security for companies that lean on third-party AI infrastructure. Uber hasn't said whether it will change how it vets providers like Fireworks, but with state regulators now holding the filings, that question won't stay unanswered for long.