Uber Confirms Hackers Stole Thousands of Drivers' License Data in Third-Party Breach
Uber is notifying thousands of drivers that their personal and driver's license information was stolen during an October data breach at one of the company's technology providers.
Breach Traced to Fireworks AI
In notices filed this week with several U.S. attorneys general, including California, the ride-hailing giant said it was notified on October 9 by the provider that hackers had broken in and stolen internal credentials. Those credentials were then used to access Uber's data.
Uber said it subsequently began notifying affected drivers whose personal information was stored with the provider.
TechCrunch has learned that the provider is Fireworks AI, which lets developers access and use open AI models. Fireworks reported a data breach last month in which hackers stole customer information, including billing data and some private AI datasets.
Online productivity startup Notion confirmed that its data was also stolen in the Fireworks hack.
"The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data," an Uber spokesperson told TechCrunch, deferring further questions to Fireworks.
Uber did not disclose how many customers are affected by the breach, nor how many drivers it is notifying. A Fireworks spokesperson did not respond to questions about the incident.
Scope of the Stolen Data
According to data breach notices seen by TechCrunch, the stolen data includes driver's licenses belonging to:
- 2,567 individuals in Massachusetts
- 3,430 people across South Carolina
- 1,873 residents of Rhode Island
A filing with Illinois indicated that some state residents had their driver's license information stolen, but the number of affected people was pending. Uber also notified drivers living in California but did not say how many had their information stolen.
The total number is expected to rise as more data breach notifications are filed.
Financially Motivated Attack
Fireworks attributed its breach to a financially motivated cybercriminal group seeking to sell stolen tokens used to access large language models (LLMs). No known cybercriminal group has taken credit for the data theft.
Uber's Second Known Breach This Year
This is Uber's second known data breach in 2026. The company previously reported a security incident at its Uber Freight truck shipping unit, for which an extortion gang took credit for stealing data.
via TechCrunch