Uber confirms thousands of drivers' licenses stolen in vendor breach

At least 7,870 drivers across three states had their driver's license information stolen in an October breach at one of Uber's technology providers, and the total is expected to climb as more notifications reach state regulators.

Uber disclosed the incident in notices filed this week with several U.S. attorneys general, including California. The company said its provider alerted it on October 9 that hackers had broken in and stolen internal credentials, then used those credentials to reach Uber's data. TechCrunch identified the provider as Fireworks AI, a platform that lets developers access and use open AI models.

What exactly was taken?

State filings seen by TechCrunch put hard numbers on the exposure:

• 2,567 individuals in Massachusetts
• 3,430 people across South Carolina
• 1,873 residents of Rhode Island
• An undisclosed number in Illinois, where the count was listed as pending
• An undisclosed number in California, where Uber notified drivers but released no figures

Add the three confirmed states together and you get 7,870 known victims — before Illinois and California report their totals. Uber has not said how many customers or drivers are affected overall. A spokesperson for Fireworks did not respond to questions about the incident.

The stolen records go beyond license data in the broader Fireworks breach. Fireworks reported last month that hackers stole its customers' information, including billing data and some private AI datasets. Online productivity startup Notion confirmed its data was also taken in the same hack.

How did the attackers get in?

The mechanism was credential theft, not a direct assault on Uber. Hackers first compromised the vendor, Fireworks, stole internal credentials there, and then used those keys to unlock Uber data that Fireworks had access to.

An Uber spokesperson confirmed the chain: "The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data." Uber deferred further questions to Fireworks.

Fireworks attributed the breach to a financially motivated cybercriminal group whose goal is to sell stolen tokens for accessing large language models. No known cybercriminal group has taken credit for the data theft so far.

In plain terms, a company that held Uber's driver data as part of its AI tooling was robbed, and the thieves walked away with the keys to that data along with LLM access tokens they can monetize.

Why this keeps happening to Uber

This is Uber's second known data breach this year. The company previously reported a security incident at Uber Freight, its truck shipping unit, where an extortion gang took credit for stealing data.

Two breaches in one year, both involving third parties or adjacent business units, points to a supply-chain problem rather than a single bad perimeter. For any enterprise, the lesson is the same: vendor access is your exposure.

Uber's driver notification count is still growing.