Uber says the Uber driver’s license information of thousands of drivers was stolen in an October breach at third‑party provider Fireworks AI, impacting riders in multiple U.S. states.
Uber disclosed that it is notifying drivers after learning that a cyber‑attack on its third‑party technology vendor, Fireworks AI, compromised internal credentials on October 9. Hackers used those credentials to access Uber’s driver data, prompting the ride‑hail company to begin notifying affected individuals whose information was stored with the provider.
Breach notices filed with several state attorneys general show that the stolen data includes driver’s licenses of 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island. A filing for Illinois indicates that residents there were also affected, though the exact number remains pending, while California drivers have been alerted without a disclosed figure. The total count is expected to rise as more notifications are processed.
Fireworks AI offers developers access to open AI models and reported the breach last month, saying hackers stole customer details, billing information and private AI datasets. Online productivity startup Notion confirmed its data was also taken in the same incident, underscoring the broader impact on companies that rely on the platform.
Uber has not released a total number of drivers impacted, but says it will continue to issue notices as new information emerges. This incident marks Uber’s second known breach in 2024, following a security event at its Uber Freight trucking division where an extortion gang claimed responsibility for data theft. No further details on compensation or additional security measures have been provided.
Investigators attribute the Fireworks breach to a financially motivated cyber‑criminal group seeking to sell stolen tokens that grant access to large language models (LLMs). No group has publicly claimed responsibility yet, but the exposure of driver’s license data raises concerns about potential identity fraud. Uber advises drivers to monitor credit reports and update passwords linked to related services to mitigate risk.
TechTimes Perspective
TechTimes believes the Uber driver’s license breach highlights the systemic risk of relying on third‑party vendors for sensitive data in the mobility sector. When personal information is stored outside a company’s core infrastructure, robust security audits and rapid incident response become critical. In Vietnam, ride‑hailing platforms that adopt similar architectures may face heightened regulatory scrutiny and consumer demand for stronger data encryption and transparent breach notifications. Drivers and passengers alike could push for stricter safeguards, influencing how the industry balances innovation with privacy protection.