Uber is warning drivers that hackers stole their personal and driver’s licence information from one of its vendors, TechCrunch reported. TechCrunch identified the vendor as Fireworks AI, and Uber confirmed it.
Uber said Fireworks told it on 9 October that hackers had stolen internal credentials. Those credentials were then used to reach Uber’s data, TechCrunch said.
Uber has not said how many people were affected. Notices it filed with state attorneys general this week list 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island.
That is 7,870 so far. California and Illinois residents were also notified, without a count, so the total is likely to rise.
Fireworks, valued at $17.5bn in July, sells developers access to open AI models. It has disclosed two incidents from October. In the first, intruders misused internal credentials. In the second, they reached its development machines through a breach at a cloud provider.
Fireworks says the attackers took billing data. For some customers, they also took secrets, datasets and unfinished model weights. Notion has said AI chat transcripts from fewer than 1% of its workspaces were exposed.
Fireworks blamed a group that sells stolen access to AI models for profit. That practice, known as LLMjacking, turns AI credentials into a product.
It is unclear why driver licence data sat with an AI inference provider. Uber referred other questions to Fireworks, which did not answer TechCrunch’s specific questions.
It is Uber’s second known breach this year, after an Uber Freight incident in August. No group has claimed the theft from Fireworks.