Hackers stole thousands of Uber drivers' license data through a breach at AI vendor Fireworks

Uber is notifying thousands of US drivers that hackers stole their personal information and driver's license details in an October breach at one of its technology providers 1

1

. The provider is Fireworks AI, an AI infrastructure startup whose platform lets developers run open AI models 1

1

. The data came from the vendor's systems rather than Uber's own, per the breach notices 1

1

.

How the intrusion happened

Fireworks told Uber about the incident on October 9. By October 13, Uber's investigation had determined that hackers used compromised internal credentials to reach Uber data held with the provider 2

2

. Uber's letters say it is notifying drivers because its investigation concluded their personal information was among the data reached through the compromised provider 2

2

.

The root incident sits with Fireworks, the vendor holding Uber's data. It disclosed its own breach in October, then updated it: hackers got in through the startup's cloud provider and reached account and billing information 1

1

. For a limited set of accounts, it also found exposure of secrets, datasets and incomplete models 1

1

.

Uber's exposure flows from that breach 1

1

. Fireworks says the attackers behind the Uber exposure were after money. The practice, which it calls LLMJacking, involves stealing credentials to get at large language models and selling that access to others 2

2

. Google has previously warned about the same practice 2

2

. No known group has claimed the attack, and the attribution is Fireworks' own 1

1

.

How many drivers, and what they get

Formal breach filings put the count at least 7,870 drivers across three states, and it is expected to rise. That includes 2,567 in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island 1

1

. PCMag adds 1,071 more in Vermont 2

2

. Uber also notified drivers in California, New York, Maryland, North Carolina and Washington, D.C., per PCMag's reading of the letters, with no counts given 2

2

. An Illinois filing shows affected residents but a pending tally 1

1

.

Uber says it cut its data connections with the provider to stop further access. It is offering free credit monitoring and fraud help to affected drivers through Cyberscout, with 90 days to sign up 2

2

. Uber says it had not identified any misuse of the stolen data as of its November 10 notice 5

5

.

Every driver must upload a license and financial documents to drive, per Uber's own policies 4

4

. Third-party estimates put the company's driver and courier base above 10 million, so the confirmed count is a small slice 4

4

. It is also the company's second known breach this year, after hackers claimed in August to have taken nearly a million files from Uber Freight 1

1

. Uber Freight confirmed unauthorized access but never verified the figure.

Notion was also caught up in the Fireworks breach: the company says customers' AI chat transcripts were exposed, affecting fewer than 1% of its workspaces 2

2

. Fireworks claims on its website to serve over 10,000 companies, including Zillow, Samsung and Notion 5

5

.

The California attorney general's office reported receiving notice of the breach on October 7, two days before the October 9 date Uber gives for learning of it 5

5

. Uber has given no national total for how many drivers were affected, and the state filings mark a floor 1

1

. The forensics, handled with Palo Alto Networks' Unit 42, are continuing, and Fireworks has not responded to press questions.