Uber Tells Thousands of Drivers Their Licence Details Were Stolen in Fireworks AI Breach

Uber has begun notifying thousands of its drivers that their personal information, including driver's licence details, was stolen in a data breach at one of its technology providers. The company confirmed the incident in notices filed this week with attorneys general in several US states, including California.

The breach did not happen on Uber's own systems. Instead, hackers broke into Fireworks AI, a third-party company that hosts open AI models for developers and held Uber data on its platform. TechCrunch, which first reported the notices, identified Fireworks as the provider, and an Uber spokesperson confirmed the identification.

What was stolen, and how many drivers are affected

Uber has not disclosed a nationwide total, but the state filings seen so far give a clear picture of the scale. According to breach notices reviewed by TechCrunch, driver's licence information was stolen for 2,567 people in Massachusetts, 3,430 people in South Carolina and 1,873 residents of Rhode Island — nearly 7,900 drivers across those three states alone.

More filings are still coming. A filing in Illinois shows that some residents there also had licence information stolen, but the number was still pending when the notice was submitted. Uber has also notified drivers living in California without saying how many were affected there. TechCrunch reports that the number is expected to rise as more state notifications roll in.

The notices say the stolen material includes personal information and driver's licence details belonging to drivers whose information was stored with the provider. Uber has said it found no evidence so far that the stolen data has been misused.

How the breach unfolded

The incident began at Fireworks AI in early October. Fireworks says it identified unauthorised use of its internal credentials on October 6 and began containing the intrusion the same day. It started notifying affected customers on October 7 and published its first security bulletin on October 9.

Uber was told on October 9 that hackers had stolen the provider's internal credentials and used them to reach Uber's data. On October 13, Uber's own investigation confirmed that the attackers had accessed its data, including personal information belonging to drivers. The notification letter sent to affected drivers is dated November 10.

Uber says it immediately cut off its data connections with Fireworks after learning of the breach, and that its own production systems, user accounts, payment details and trip history were not touched.

The Fireworks breach is wider than first reported

Fireworks first disclosed the incident in October as a credential leak. On November 9, it published an update that widened the picture considerably: the attackers had also reached billing data and, for a limited set of accounts, secrets, datasets and incomplete model weights.

The company also disclosed a second intrusion path. A third-party cloud provider hosting Fireworks' research and development machines suffered a security incident on October 23, and the next day the attacker used that foothold to reach Fireworks' development machines and run an unauthorised workload. Fireworks says it detected that activity the same day, and that as of October 25 it had not detected further successful unauthorised access on the platform customers use.

Fireworks has linked the activity to a financially motivated cybercriminal group that steals access tokens for large language models and sells them through illicit routing gateways, a scheme known as LLMjacking. No known group has publicly claimed responsibility for the theft. Fireworks says it notified law enforcement and brought in Palo Alto Networks Unit 42 for forensic analysis.

Notion was caught in the same breach

Uber is not the only Fireworks customer affected. Notion, the productivity startup, has confirmed that some of its data was also stolen in the Fireworks hack, including some unattributable Notion AI chat sessions. Notion said fewer than 1% of its workspaces may have been affected, disconnected its systems from Fireworks on November 3, deleted all of its data in the Fireworks system and disabled its Insights feature.

We reported on the Notion side of the breach earlier: Notion Confirms AI Chat Transcripts Exposed in Fireworks AI Breach.

Uber's second breach this year

TechCrunch notes that this is Uber's second known data breach this year. The company earlier reported a security incident at its Uber Freight truck-shipping unit, for which an extortion gang took credit for stealing data.

For drivers, the incident is a reminder of how far a vendor's security failure can reach. A driver's licence is a valuable piece of identity data: it can be used for identity theft, and it cannot be changed the way a password can. Affected drivers should watch for unusual activity, consider placing a fraud alert with a credit bureau, and follow the guidance in the notice they receive from Uber.

Sources

• TechCrunch — Uber confirms hackers stole thousands of drivers' license information in data breach
• Gizmodo — Uber Data Breach Exposes Thousands of Drivers Through AI Firm
• Cyber Security News — Uber Confirms Data Breach
• AI Secure Platform — Fireworks AI Breach Widens: Billing Data, Datasets and Partial Model Weights Accessed
• Innopark IT — Notion Confirms AI Chat Transcripts Exposed in Fireworks AI Breach