Bad newsUber Tells Drivers Their Licences Were Stolen in AI Vendor Breach
Uber is notifying thousands of US drivers that hackers took their driver’s licence data from Fireworks AI, a vendor. Filings count nearly 7,900 people in three states, and Uber has not said how many drivers are affected in total.
This story runs on the bad side only. The biggest stories of the day are told on both sides.
Uber is telling thousands of drivers that their personal details and driver’s licences were stolen in a breach at one of its technology suppliers. The company said in notices filed with several US state attorneys general this week that the supplier warned it on 9 October, TechCrunch reports. Hackers had broken in and taken internal credentials, which they then used to reach Uber’s data.
The notices do not name the supplier. TechCrunch learned that it is Fireworks AI, a company that lets developers use open AI models. Fireworks reported a breach last month in which hackers took customer information, including billing data and some private AI datasets, as an earlier story on the breach described.
How many drivers
Uber has not said how many drivers are affected, nor how many it is notifying. The filings give partial counts. They list driver’s licences for 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island, which adds up to 7,870. An Illinois filing shows some residents were affected but gives no number, and Uber has notified California drivers without a count, TechCrunch says.
Mashable puts the number alerted so far at almost 8,000 accounts across the three states. Uber says it will notify every affected worker. Third-party estimates put its fleet at more than 10 million drivers and couriers, so the three-state figure is a small slice, and TechCrunch expects it to rise as more notices arrive.
Who holds the data
The company deflected questions. A spokesperson told TechCrunch the notices concern a security incident at a third-party vendor, Fireworks.ai, which had access to some Uber data, and referred other questions to Fireworks. A Fireworks spokesperson confirmed unauthorised access to some of its systems that affected customer data, but did not answer TechCrunch’s questions about it.
Uber requires every driver to upload proof of a valid driver’s licence, insurance and residency, along with bank statements and payment information, Mashable notes. That is a lot of identity documents to leave with a supplier that sells access to AI models. The reports do not say why a model vendor held licence images, or for how long.
Fireworks blames a financially motivated criminal group whose goal is to sell stolen tokens for access to large language models. No known group has claimed the theft of the data. According to Mashable, the attackers got in through the vendor’s cloud provider and then used internal credentials to reach client data.
What drivers can do
The licence is the most sensitive item in the leak, because it is hard to replace and useful for identity fraud. The notices drivers receive will set out the steps their state requires. None of the sources we read says whether Uber is offering credit monitoring or identity protection, and it is worth checking the notice for that.
This is Uber’s second known breach this year, TechCrunch says. The first hit its Uber Freight truck shipping unit, and an extortion gang took credit for it. The pattern is familiar: the company that collects the data is not always the one that loses it. Uber says it was warned on 9 October, and the attorney general filings that surfaced the breach were made this week.
