Uber Discloses Driver's License Theft in Fireworks AI Breach

Uber has notified thousands of drivers that their personal information and driver's licenses were stolen in a third-party cybersecurity breach, according to regulatory disclosures submitted to state attorneys general and reported by Mashable Tech (https://mashable.com/tech/uber-hack-stolen-drivers-licenses).

The unauthorized intrusion occurred at Fireworks AI, an artificial intelligence infrastructure provider that alerted Uber after hackers accessed several of its client databases. Reporting by TechCrunch previously identified Fireworks AI as the vendor behind the incident, which also affected other technology customers, including productivity software provider Notion.

Fireworks AI disclosed that the attackers gained access to its cloud infrastructure and development systems, allegedly motivated by an effort to steal and resell large language model tokens. Intruders then leveraged internal administrative credentials to access client datasets and billing information across a small percentage of the vendor's client base. In Notion's case, the attackers obtained anonymized chat transcripts from users interacting with its AI assistant.

To operate on the platform, Uber requires its gig workers to upload sensitive identity and financial records, including government-issued driver's licenses, proof of insurance and residency, bank statements, and payment details. The exposure of government identification documents poses direct identity theft and fraud risks for affected workers, whose credentials were held by an external machine-learning partner.

Uber has not disclosed the total number of drivers affected nationwide, but confirmed it will send breach notifications to all compromised workers. Disclosures reviewed so far indicate the company has notified nearly 8,000 drivers across Massachusetts, South Carolina, and Rhode Island as state regulators review the filings.