Ride-hailing giant Uber is currently in the process of notifying thousands of its drivers across the United States that their sensitive personal data, including driver’s license information, was compromised during an October data breach. The security incident did not originate within Uber’s own direct infrastructure, but rather stemmed from a cyberattack targeting one of the company’s third-party technology providers.
According to official data breach notices filed this week with several state attorneys general—including authorities in California—Uber was alerted on October 9 by the third-party vendor. The vendor informed the transportation network company that unauthorized hackers had successfully breached its systems. During the intrusion, the threat actors managed to steal internal credentials, which were subsequently weaponized to access and exfiltrate data belonging to Uber.
Following the notification from its vendor, Uber initiated an internal investigation and quickly began preparing notifications for the affected drivers whose personal information had been stored within the third-party provider’s environment. While the exact total of impacted individuals across the entire country remains undisclosed by the ride-hail company, public disclosures filed in multiple states are already shedding light on the broad geographical footprint of the breach.
Industry reporting has identified the third-party vendor involved in the security incident as Fireworks AI, a prominent technology platform that allows developers to access, integrate, and deploy open-source artificial intelligence models. Fireworks AI itself publicly reported a data breach last month, revealing that hackers had successfully infiltrated its systems to steal valuable customer information, including sensitive billing data and private AI datasets belonging to various corporate clients.
The fallout from the Fireworks AI cyberattack has impacted multiple prominent technology companies. In addition to Uber’s exposure, online productivity startup Notion confirmed shortly after the incident that its own corporate data had also been compromised and stolen during the same breach at Fireworks AI.
When contacted for comment regarding the incident, an Uber spokesperson pointed directly to the third-party vendor responsible for the exposure. "The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data," the spokesperson stated, while deferring all further operational and technical questions regarding the breach to Fireworks AI.
As of press time, Uber has refrained from publicly disclosing the exact number of total customers or drivers affected by the security lapse. Furthermore, a spokesperson for Fireworks AI did not respond to multiple requests for comment concerning how the breach occurred or the specific measures being taken to remediate the vulnerabilities.
Despite the lack of a comprehensive national total, preliminary data breach filings submitted to various state regulatory bodies reveal that thousands of drivers have already been confirmed as victims. State-level disclosures reviewed by reporters indicate that the stolen data includes the driver’s licenses of 2,567 individuals residing in Massachusetts, 3,430 people across South Carolina, and 1,873 residents of Rhode Island.
Additional regulatory filings submitted in Illinois confirmed that state residents had their driver’s license information stolen in the attack, though the precise count for that state remains listed as pending while investigations continue. Uber has also begun issuing formal notifications to affected drivers living in California, though the company similarly omitted figures regarding the total scale of the compromise within that state.
Cybersecurity experts anticipate that the overall tally of impacted individuals will continue to climb steadily in the coming weeks as more state-level data breach notifications are officially processed and published.
Regarding the attribution of the cyberattack, Fireworks AI has previously attributed the breach to a financially motivated cybercriminal collective. According to the AI platform, the primary objective of the hackers is to illicitly acquire and subsequently sell stolen authentication tokens. These tokens are typically utilized to access and abuse large language models, commonly referred to as LLMs, for unauthorized computing power or data extraction. Despite these preliminary assessments regarding the group’s motives, no known or prominent cybercriminal syndicate has publicly stepped forward to take credit for the data theft at Fireworks AI.
The security incident marks the second known data breach experienced by Uber over the course of the year. Earlier this year, the company was forced to address a separate security event impacting its Uber Freight truck shipping and logistics unit. During that previous incident, an extortion-focused hacking group publicly claimed responsibility for stealing internal data from the logistics division, forcing the ride-hail giant to launch a comprehensive incident response investigation.