Uber data breach exposes driver's licence details of thousands
Uber is telling drivers that their personal and licence information was stolen in an October hack at its AI vendor Fireworks AI, according to filings with US state attorneys general.
Key takeaways
- Uber is notifying drivers whose licence data was stolen in an October breach at vendor Fireworks AI.
- State filings show at least 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island were affected.
- Fireworks AI blames a financially motivated group that sells stolen tokens for accessing large language models.
- It is Uber's second known breach this year, after an incident at its Uber Freight unit.
In this article
What happened
Uber is notifying thousands of drivers that their personal details and driver's licence information were stolen in a data breach, according to TechCrunch. The information was held by Fireworks AI, a company that provides cloud access to open AI models and worked with Uber as a third-party vendor.
Uber learned on 9 October that hackers had broken into the provider and taken internal login credentials. Those credentials were then used to reach Uber's data stored with the vendor.
How many drivers are affected
Uber has not said how many drivers in total are affected. Figures from breach filings seen by TechCrunch show the stolen licence data covers 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island.
An Illinois filing confirmed that some residents there were also affected, but the count is still pending. Uber also contacted drivers in California without giving a number, and the total is expected to grow as more state notifications are filed.
The wider Fireworks AI hack
Fireworks AI disclosed its own breach last month, saying attackers took customer information including billing records and some private AI datasets. The company attributes the attack to a financially motivated cybercriminal group that aims to sell stolen tokens for accessing large language models, which are the AI systems behind chatbots and other generative tools.
No known criminal group has claimed responsibility. The productivity startup Notion has also confirmed that its data was taken in the same incident, and Fireworks has not answered questions about the Uber exposure.
A pattern for Uber
This is the second known breach at Uber this year. The company previously reported a security incident at Uber Freight, its truck shipping unit, where an extortion gang claimed it had stolen data.
The latest case shows how a company's data can be exposed through a supplier rather than its own systems. Uber has deferred questions to Fireworks, and drivers who receive a notice should follow the guidance it contains, such as reviewing their licence records for misuse.
Sources
Spotted a mistake? See our corrections policy. Read how News by OnDevice works in our editorial policy.
Related news
More Software news
Jensen Huang reportedly doubted interim CEO Colette Kress before exit
The Wall Street Journal reports Huang criticised Nvidia CFO Colette Kress in a summer meeting, months before he resigned and she became interim CEO.
Nvidia leadership turmoil puts Israel's tech sector on alert
Jensen Huang's resignation has unsettled Israel's startup ecosystem, where Nvidia employs 6,000 people and runs its largest R&D site outside the US. Investors see a chance for AI chip challengers, but warn the opportunity comes with risks.
Microsoft 365 outage hits Teams, Outlook and Azure for over 12 hours
A widespread server problem has disrupted Microsoft's cloud services across more than 74 countries, with the NHS among the affected organisations. Microsoft says the cause is overloaded servers, not a cyberattack.
X-energy wins US approval to build its first four small modular reactors
The nuclear startup X-energy has received a construction permit from the US Nuclear Regulatory Commission for four reactors in Texas, but safety experts have raised concerns about how quickly the approval came through.