Uber is notifying thousands of drivers that hackers obtained personal information, including driver’s license data, during an October breach at Fireworks AI, a technology provider used by the ride-hailing company. Uber disclosed the incident in breach notices filed this week with several state attorneys general.
Uber said Fireworks told the company on Oct. 9 that attackers had entered its systems after stealing internal credentials. Those credentials were then used to reach data belonging to Uber. The company said it began contacting affected drivers after learning that their information was held by the provider.
“The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data,” an Uber spokesperson told TechCrunch.
State filings identify thousands of drivers
The notices reviewed by TechCrunch identify affected driver’s license information in at least four states. Uber has not disclosed the total number of drivers receiving notices, and it has not said how many Uber customers may be involved. Additional state filings could increase the reported count.
| State | People identified in filing | Information reported |
|---|---|---|
| Massachusetts | 2,567 | Driver’s licenses |
| South Carolina | 3,430 | Driver’s licenses |
| Rhode Island | 1,873 | Driver’s licenses |
| Illinois | Pending | Driver’s license information |
Uber also notified drivers in California, but the filing did not state how many people there were affected. The disclosures describe the stolen information as belonging to drivers whose data had been stored with Fireworks. They do not establish that every Uber driver or customer was affected.
Fireworks says customer data was affected
Fireworks confirmed that it found unauthorized access involving some of its systems and that customer data was affected. The company did not provide additional details about the incident. Fireworks reported the breach last month after hackers took customer information, including billing data and some private artificial-intelligence datasets.
Notion, an online productivity company, has also confirmed that data was taken in the Fireworks incident. Fireworks attributed its breach to a financially motivated cybercriminal group. The available disclosures identify the group’s objective as selling stolen access tokens, which are digital credentials that can be used to enter certain systems.
For affected drivers, the incident adds driver’s license information to the personal data exposed through a technology provider serving multiple companies. Uber’s notices identify the states and counts reported so far, but the company has not released a nationwide total. Uber referred questions about the provider’s security incident to Fireworks, while Fireworks did not address questions about the scope of the breach.
- Uber drivers: Notices concern personal and driver’s license information stored with Fireworks AI.
- Reported numbers: Filings identify 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island.
- Scope: Uber has not disclosed the total number of affected drivers or customers, and more notices may follow.
