Uber confirms driver data stolen via Fireworks AI breach
Original: Uber confirms hackers stole thousands of drivers’ license information in data breach
Why This Matters
Third-party AI vendors are emerging as a significant attack surface for large enterprises.
Uber is notifying thousands of drivers after hackers stole personal and license data via AI provider Fireworks AI in October. Confirmed victims span Massachusetts (2,567), South Carolina (3,430), and Rhode Island (1,873), with more states pending.
Uber is notifying drivers that their personal information and driver's license data were stolen during an October breach at Fireworks AI, an AI model hosting provider. Uber said it learned of the incident on October 9, when Fireworks reported that hackers had stolen internal credentials and used them to access customer data, including billing records and private AI datasets.
According to breach notices filed with multiple U.S. attorneys general, at least 7,870 individuals across Massachusetts, South Carolina, and Rhode Island have confirmed exposure. Illinois and California filings are outstanding, with affected counts still pending — meaning the total will rise.
Fireworks attributed the attack to a financially motivated group seeking to sell stolen LLM access tokens, though no cybercriminal group has publicly claimed responsibility. Notion also confirmed its data was caught up in the same Fireworks breach.
An Uber spokesperson confirmed the incident was tied to Fireworks.ai and deferred further questions to the vendor. Fireworks confirmed unauthorized access to its systems but declined to answer specific questions.
This marks Uber's second disclosed breach in 2026. Earlier this year, an extortion gang claimed responsibility for stealing data from Uber Freight.