Uber confirms hackers stole thousands of drivers’ license information in data breach

Uber is notifying thousands of drivers that their idiosyncratic and driver’s licence accusation was stolen during an October information breach astatine 1 of the company’s tech providers.

In notices filed this week with respective U.S. attorneys general, including California, the ride-hail elephantine said it was notified connected October 9 by the supplier that hackers broke successful and stole interior credentials, which were utilized to entree Uber’s data.

The institution said it subsequently began notifying affected drivers that their idiosyncratic accusation was stored with the provider.

TechCrunch has learned that the supplier is Fireworks AI, which lets developers entree and usage unfastened AI models. Fireworks reported a information breach past period successful which hackers stole its customers’ information, including billing information and immoderate backstage AI datasets.

Online productivity startup Notion confirmed its information was besides stolen successful the Fireworks hack.

“The notices to drivers are successful narration to a information incidental impacting 1 of our third-party vendors, Fireworks.ai, which had entree to immoderate Uber data,” an Uber spokesperson told TechCrunch, deferring our questions to Fireworks. 

Uber did not accidental however galore customers are affected by the breach, nor however galore drivers it was notifying astir the incident. A spokesperson for Fireworks did not respond to questions astir the incident.

According to information breach notices seen by TechCrunch, the stolen information includes driver’s licenses of 2,567 individuals successful Massachusetts, 3,430 radical crossed South Carolina, and 1,873 residents of Rhode Island. A filing with Illinois showed that immoderate authorities residents had their driver’s licence accusation stolen, but that the fig of affected radical was pending. Uber besides notified drivers who unrecorded successful California, but did not accidental however galore had their accusation stolen.

The fig is expected to emergence arsenic much information breach notifications rotation in.

Fireworks attributed its breach to a financially motivated cybercriminal radical whose goals are to merchantability stolen tokens for accessing ample connection models, oregon LLMs. 

No known cybercriminal radical has taken recognition for the information theft.

This is Uber’s 2nd known information breach this year. The institution reported a information incident astatine its Uber Freight motortruck shipping unit, for which an extortion pack took recognition for stealing data.