Ride-hailing giant Uber has confirmed that thousands of its drivers had their personal and driver’s license information stolen following a breach in October at one of its technology suppliers. The incident stems from compromised credentials providing unauthorized access to Uber data, resulting in notification filings with multiple U.S. state attorneys general over the past week.
Incident Details and Scope
On October 9, Uber was alerted that one of its third-party vendors—identified as Fireworks AI—had suffered a breach. Attackers gained access to internal credentials, which they used to reach Uber data stored by the vendor. Uber only learned of the specific breach when Fireworks notified it, triggering investigations and consumer notifications.
Driver’s license numbers and other personal data were among the information accessed. Notifications reveal that in Massachusetts, 2,567 drivers were impacted; in South Carolina 3,430; in Rhode Island 1,873. A notice in Illinois confirmed some drivers there were affected, though no exact total has been disclosed. California notifications are underway, but Uber has not specified how many people were exposed there. It’s expected that more disclosures could increase the overall tally of affected individuals.
Root Cause and Wider Implications
The breach is traced to Fireworks AI, which provides services allowing developers to access and deploy open AI models. Alongside Uber, Fireworks also counts other customers—such as a note-taking startup—in the list of entities hit during the attack. The motive behind the compromise is reportedly financial: the stolen credentials and tokens were intended to be sold for access to large language models.
This marks Uber’s second major breach this year. Earlier, its Uber Freight division was hit by an extortion gang that claimed to have stolen corporate data, setting off its own wave of concern over security across its operations.
The exact number of drivers affected nationwide is not yet known, and Fireworks has not publicly clarified how the breach unfolded or the full list of impacted clients. Uber has begun informing affected drivers, as required by state laws.
While Uber has initiated breach notices and is cooperating with state regulators, the exposure of driver’s license data introduces heightened risk due to the potential for identity theft and fraud. The breach also underscores increasing vulnerabilities when companies rely on third-party AI service providers with access to sensitive data.
Analysis: This breach highlights a growing risk in how companies manage their supply chains—especially when those chains include AI vendors who hold or process sensitive information. Uber’s exposure here is not just a one-off; it reflects a broader issue in the tech ecosystem. Regulators and businesses need to push transparency around third-party data practices, and ensure stricter security postures when vendor access overlaps with highly personal data. For users and stakeholders, this serves as a warning: even indirect connections—through subcontractors or service providers—can lead to serious privacy consequences. Going forward, it will be critical to watch how Fireworks responds publicly, how Uber improves its vendor oversight, and whether new legislation or standards arise to close these gaps.
